@lincyaw/workbench@0.2.0-rc.0
Presmium's workbench panels in React (the documents, a document edited on its rendered page with comments and version history) with the workspace service's client and the preview protocol's workbench side; @lincyaw/dsh places them in presmium studio (expe
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package intentionally gates telemetry on a host setting and sends it to the same-origin workspace service, so the source does not establish an unrelated-collector attack. However, enabled telemetry includes full agent request text without a per-user consent step, which is a meaningful runtime privacy risk.
Decision evidence
public snapshot- Workbench construction automatically starts operation logging.
- An agent ask records the full composed request text as a telemetry attribute.
- The client sends telemetry batches to the host at /api/presmium/telemetry.
- Recording is gated by the host returning enabled: true, with failures defaulting to disabled.
- Telemetry is sent to the workspace host over a same-origin route, not to an unrelated external collector.
- The host can disable collection by returning enabled: false.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/places.ts#virtual:normalized:round1View on unpkgWorkbench construction automatically starts operation logging.
src/workbench.tsView on unpkg · L435Findings
Affected versions and remediation
This report applies to @lincyaw/workbench@0.2.0-rc.0.
See all versions of @lincyaw/workbench for other recorded verdicts.
- Review the evidence and your use of @lincyaw/workbench@0.2.0-rc.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.