registry / sky-render / 0.0.2-beta.18

sky-render@0.0.2-beta.18

天幕低代码运行时渲染器：将设计器导出的加密 JSON 配置解析为 Vue 3 页面/项目并挂载运行

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The renderer executes JavaScript embedded in supplied low-code project configuration. This is a runtime capability activated by application-provided local or remote configuration, not an install-time package attack.

Static reason

No blocking static signals were detected.

Trigger

Consumer calls createProject, generateComponent, remoteCreateProject, or remoteComponent with configuration.

Impact

An untrusted configuration source could execute JavaScript in the host application's browser context.

Mechanism

Dynamic Function evaluation of configuration fields.

Rationale

No concrete malware, persistence, exfiltration, or lifecycle abuse was found. Its configuration-driven dynamic execution is a real dangerous capability that warrants a warning when exposed to untrusted configuration.

Evidence

package.jsondist/sky-render.cjs.jsdist/index.d.tsdist/sky-render.esm.jsREADME.en.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/sky-render.cjs.js uses new Function on project configuration fields.
remoteCreateProject and remoteComponent fetch caller-supplied configuration URLs.

sky-render@0.0.2-beta.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code