registry / @intentius/chant-lexicon-github / 0.18.5

@intentius/chant-lexicon-github@0.18.5

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only network operation is an explicit schema-fetch helper, and build-time writes target this package's generated dist artifacts.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes schema generation/fetch APIs or maintainer runs the prepack build script.

Impact

No unconsented install-time execution, credential collection, persistence, or foreign configuration mutation established.

Mechanism

User-invoked schema retrieval and package-local artifact generation.

Rationale

Static inspection shows a GitHub Actions lexicon with explicit generation, linting, and schema-fetch tooling. Scanner signals stem from fixed runtime requires and synthetic secret strings in tests, not concrete malicious behavior.

Evidence

package.jsonsrc/spec/fetch.tssrc/package-cli.tssrc/composites/deploy-environment.tssrc/lint/rules/no-hardcoded-secrets.tssrc/lint/rules/rules.test.ts

Network endpoints1

json.schemastore.org/github-workflow.json

Decision evidence

public snapshot

AI called this at 97.0% confidence with false-positive risk.

@intentius/chant-lexicon-github@0.18.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code