registry / @atlaskit/editor-plugin-primary-toolbar / 31.0.7
@atlaskit/editor-plugin-primary-toolbar@31.0.7
Primary toolbar plugin for @atlaskit/editor-core
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the inspected entry points and plugin code implement a toolbar component registry and ProseMirror state initialization. No unrelated network, credential, or destructive behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Import exposes the toolbar plugin; editor setup calls the plugin factory and initializes its editor state.
Impact
No credential access, unrelated network activity, install-time behavior, or harmful account or file actions were identified.
Mechanism
The code registers UI components and selects toolbar components from the registry and editor configuration.
AI rationale
The manifest has no lifecycle scripts, and the inspected entry points and plugin code implement a toolbar component registry and ProseMirror state initialization. No unrelated network, credential, or destructive behavior was found.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies an Atlassian primary toolbar plugin and has no lifecycle scripts; its main entry is dist/cjs/index.js.
- The CommonJS entry exports the primaryToolbarPlugin from its local module.
- The plugin builds a component registry and returns toolbar actions and a ProseMirror plugin using the supplied configuration.
- The plugin state initializes toolbar components from the registry; component registration stores the supplied component by name.
Evidence against
Behavioral surface
Source & flagged code
5 flaggedpackage.jsonView file
2"name": "@atlaskit/editor-plugin-primary-toolbar",
"version": "31.0.7",
"description": "Primary toolbar plugin for @atlaskit/editor-core",
"author": "Atlassian Pty Ltd",
"lice
Low
Suspicious Lifecycle Evidence
The manifest identifies an Atlassian primary toolbar plugin and has no lifecycle scripts; its main entry is dist/cjs/index.js.
package.jsonView on unpkg · L2dist/cjs/index.jsView file
6Object.defineProperty(exports, "primaryToolbarPlugin", {
enumerable: true,
get: function get() {
return _pr
Low
Ai Review Evidence
The CommonJS entry exports the primaryToolbarPlugin from its local module.
dist/cjs/index.jsView on unpkg · L6dist/cjs/primaryToolbarPlugin.jsView file
Findings
5 Low
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cjs/index.js
LowAi Review Evidencedist/cjs/primaryToolbarPlugin.js
LowAi Review Evidencedist/cjs/pm-plugins/pm-plugin.js
LowAi Review Evidencedist/cjs/editor-actions/actions.js
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-primary-toolbar@31.0.7.
See all versions of @atlaskit/editor-plugin-primary-toolbar for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-primary-toolbar@31.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.