@blario/react-native@0.1.2
Blar agent SDK for React Native
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged bundle contains general agent and API-bridge capabilities, but the React Native shell disables agent execution and passes identity data supplied by the integrating app. The package documents its bounded, disableable error reporting; the scanner’s account-hijack finding is not supported by the inspected execution path.
Decision evidence
public snapshot- The package entry point is src/index.ts; the manifest declares build and prepack scripts but no install lifecycle hook.
- The widget shell passes app-provided identity fields and configures messages-only mode with agent execution disabled.
- The bundled widget returns without processing agent commands when agent execution is disabled.
- The README discloses bounded error reporting to Blar’s Sentry, says emails and tokens are scrubbed, and documents that enabled={false} stops reporting.
Source & flagged code
5 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
src/chat/widget-bundle.generated.tsView on unpkg · L1The bundled widget returns without processing agent commands when agent execution is disabled.
src/chat/widget-bundle.generated.tsView on unpkg · L2Findings
Affected versions and remediation
This report applies to @blario/react-native@0.1.2.
See all versions of @blario/react-native for other recorded verdicts.
- Review the evidence and your use of @blario/react-native@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.