registry / @synth-framework/synth / 2.2.0

@synth-framework/synth@2.2.0

AI-native deterministic execution system for engineering work

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `synth init` or `synth bootstrap --approve`

Impact

Adds `.synth` governance guidance and can invoke user-project validation code

Mechanism

Explicit project-local agent artifact setup and project-script delegation

Rationale

No concrete malware or unconsented lifecycle behavior was found. Flag as warn because the package deliberately establishes a first-party agent-governance control surface and can delegate to project scripts.

Evidence

package.jsondist/cli/synth.jsdist/cli/bootstrap-apply.jsdist/cli/agent-artifacts.jsdist/adapters/github/client.jsdist/main.js.synth/AGENT_CONTRACT.md.synth/context.json.synth/manifest.json.synth/data/event-log.jsonl.synth/data/canonical-state.json.synth/data/checkpoints.json

Network endpoints1

api.github.com

@synth-framework/synth@2.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code