registry / @intentius/chant-lexicon-github / 0.18.0

@intentius/chant-lexicon-github@0.18.0

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime exports construct GitHub Actions workflow definitions; the only network operation is an explicit fixed-schema fetch utility.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit caller use of schema-fetch, generation, packaging, or workflow-composite APIs.

Impact

No unconsented install-time execution, foreign control-surface mutation, or data exfiltration established.

Mechanism

Package-aligned workflow lexicon, code generation, and optional schema caching.

Rationale

Static hints are explained by test token fixtures and package-aligned dynamic runtime loading. Source inspection found no concrete malicious chain.

Evidence

package.jsonsrc/composites/deploy-environment.tssrc/spec/fetch.tssrc/package-cli.tssrc/plugin.tssrc/lint/rules/rules.test.ts

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no bin or install lifecycle hook; prepack is publish-time only.

@intentius/chant-lexicon-github@0.18.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code