registry / @intentius/chant-lexicon-github / 0.18.6

@intentius/chant-lexicon-github@0.18.6

GitHub Actions lexicon for chant — declarative IaC in TypeScript

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The only network behavior is an explicit schema-generation fetch, and filesystem writes are explicit build/package artifact generation.

Static reason

One or more suspicious static signals were detected.

Trigger

User-invoked generation, packaging, or plugin command.

Impact

No install-time execution, credential collection, remote payload execution, persistence, or destructive behavior established.

Mechanism

Fetches a SchemaStore workflow schema and generates GitHub Actions lexicon artifacts.

Rationale

Static hints are explained by test secret patterns, literal runtime imports, and normal build tooling. Source inspection found no concrete malicious chain or unconsented install-time control-surface mutation.

Evidence

package.jsonsrc/spec/fetch.tssrc/package-cli.tssrc/plugin.tssrc/composites/deploy-environment.tssrc/lint/rules/rules.test.ts

Network endpoints1

json.schemastore.org/github-workflow.json

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as with false-positive risk.

@intentius/chant-lexicon-github@0.18.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code