registry / @skhema/embed / 0.1.11

@skhema/embed@0.1.11

Embeddable component for integrating strategic elements with Skhema.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a browser web component/embed library with package-aligned analytics and save links.

Static reason

No blocking static signals were detected.

Trigger

Importing/using skhema-element or skhema-component in a browser page.

Impact

Page URL/title, user agent, contributor IDs, content hashes/content, and click/embed events may be sent to Skhema analytics as product telemetry.

Mechanism

custom elements render cards, add structured data, and optionally send analytics unless track-analytics="false"

Rationale

Source inspection shows expected browser embed behavior with package-aligned telemetry and links, not install-time execution, credential harvesting, agent config mutation, or remote payload execution. Network and cookie usage are transparent product functions for an embeddable Skhema component.

Evidence

package.jsondist/index.cjsdist/index-B8ZF3snD.cjsdist/embed.min.js

Network endpoints4

analytics.skhema.com/functions/v1/embed-manageapp.skhema.com/saveskhema.comskhema.com/contributors/

@skhema/embed@0.1.11

AI Security Review

Decision evidence

Source & flagged code

Findings