registry / @sarimarcus/content-sites-ui / 0.36.0
@sarimarcus/content-sites-ui@0.36.0
Universal Astro UI components, layout shell and design tokens shared by the content sites.
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found no install-time execution or concrete attack behavior. The flagged network references map to site integrations, while the required high-finding component only renders supplied content.
Static reason
No blocking static signals were detected.
Trigger
A consuming site renders the relevant component or explicitly sets up an exported browser feature.
Impact
These integrations transmit ordinary page or tool data to their configured services; no credential theft, destructive behavior, persistence, or unauthorized account action was found.
Mechanism
Components load configured widget resources; analytics records page events; WebMCP forwards input only when a browser tool is called.
AI rationale
Source inspection found no install-time execution or concrete attack behavior. The flagged network references map to site integrations, while the required high-finding component only renders supplied content.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes UI source modules and declares no install lifecycle hook or runtime self-dependency.
- src/affiliate/AffiliateBandShell.astro renders supplied content as a section; the required high-finding path contains no executable behavior.
- Analytics writes event data to the browser data layer and returns when the loaded consent manager denies analytics consent; without the manager it relies on GTM consent mode.
- Affiliate widget scripts use a source URL supplied by the consuming site, and the isolated variant runs in a sandboxed iframe.
- WebMCP setup does nothing without browser model-context support; remote calls use a configured endpoint and run when a registered tool is executed.
- Third-party analytics scripts are deferred until interaction or page idle; the referenced affiliate hosts are declared as widget resources.
Evidence against
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedsrc/affiliate/AffiliateBandShell.astroView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 98
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/affiliate/AffiliateBandShell.astroView on unpkg20<section id={id} class:list={[sectionClass, className]}>
<div class="max-w-shell mx-auto px-4 sm:px-6 lg:px-8">
<div class:list={["flex flex-wrap items-baseline justify-between gap-x-6 gap-y-1", subtitle ? "mb-2" : "mb-8"]}>
<h2 class={he
Low
Ai Review Evidence
src/affiliate/AffiliateBandShell.astro renders supplied content as a section; the required high-finding path contains no executable behavior.
src/affiliate/AffiliateBandShell.astroView on unpkg · L20package.jsonView file
Findings
1 High1 Medium10 Low
HighSemantic Analysis Limitedsrc/affiliate/AffiliateBandShell.astro
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/affiliate/AffiliateBandShell.astro
LowAi Review Evidencesrc/layout/analytics.ts
LowAi Review Evidencesrc/affiliate/TravelpayoutsWidgetBody.astro
LowAi Review Evidencesrc/layout/webMcp.ts
LowAi Review Evidencesrc/layout/webMcp.ts
LowAi Review Evidencesrc/layout/ConsentAnalytics.astro
Affected versions and remediation
This report applies to @sarimarcus/content-sites-ui@0.36.0.
See all versions of @sarimarcus/content-sites-ui for other recorded verdicts.
- Review the evidence and your use of @sarimarcus/content-sites-ui@0.36.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.