registry / @intentius/chant-lexicon-github / 0.16.0

@intentius/chant-lexicon-github@0.16.0

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation imports TypeScript source through package exports without lifecycle execution; the only network behavior is an explicit schema-fetch helper.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit caller invocation of fetchWorkflowSchema, code generation, packaging, or MCP workflow-analysis tools.

Impact

No credential harvesting, exfiltration, shell execution, persistence, or foreign AI-agent control-surface mutation found.

Mechanism

GitHub Actions workflow lexicon, generator, linter, and opt-in schema cache.

Rationale

Direct inspection shows a package-aligned GitHub Actions lexicon. Scanner signals are explained by fixed runtime imports, lint-test secret fixtures, and an explicit SchemaStore cache helper, not an attack chain.

Evidence

package.jsonsrc/index.tssrc/plugin.tssrc/composites/deploy-environment.tssrc/spec/fetch.tssrc/mcp/context-tools.tssrc/lint/rules/rules.test.tssrc/package-cli.ts~/.chant/github-workflow-schema.jsonsrc/generated/dist/

Network endpoints1

json.schemastore.org/github-workflow.json

@intentius/chant-lexicon-github@0.16.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code