registry / @intentius/chant-lexicon-github / 0.18.1

@intentius/chant-lexicon-github@0.18.1

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious runtime or install-time attack surface. The package provides GitHub Actions workflow definitions, lint rules, and explicit code-generation utilities.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit caller import or invocation; schema retrieval requires calling `fetchWorkflowSchema`/generation tooling.

Impact

May write a local schema cache or package build artifacts only when explicitly invoked; no unconsented package-install action was found.

Mechanism

Workflow lexicon generation with optional schema caching.

Rationale

Static hints are explained by legitimate lint test fixtures and package-aligned workflow/schema tooling. Direct source inspection found no concrete malicious behavior or install-time execution.

Evidence

package.jsonsrc/spec/fetch.tssrc/package-cli.tssrc/lint/rules/no-hardcoded-secrets.tssrc/lint/rules/detect-secrets.tssrc/composites/node-pipeline.tssrc/codegen/generate-cli.ts

Network endpoints1

json.schemastore.org/github-workflow.json

Decision evidence

public snapshot

@intentius/chant-lexicon-github@0.18.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code