synapse-hub
Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.
Enterprise AI Agent Intelligence Hub & Autonomous Skill Network
This report shows the evidence for synapse-hub@2.7.0. 0 of 10 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package exposes a Python-backed CLI whose launcher runs only when invoked directly. The flagged download and credential indicators are scanner rules, while the default network activity checked here retrieves package update metadata from the project’s registry and repository.
Decision evidence
public snapshot- The package entry point is a CLI launcher; importing it only exports resolvePython without starting the CLI.
- When invoked, the launcher passes CLI arguments to the bundled Python tool and inherits standard input/output.
- The CLI’s default update check is a cached version notification; it requests version metadata from the npm registry or the project’s GitHub raw package.json.
- The reported download-and-run and credential indicators in skillspector.py are scanner patterns, not code that downloads scripts or reads AWS credentials.
- The launcher invokes Python when run directly, which is expected for this package’s CLI.
- The CLI checks for updates on ordinary commands unless quiet mode is enabled, but the check targets package update metadata.
Source & flagged code
6 flaggedSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/agent-qa.jsView on unpkg · L3When invoked, the launcher passes CLI arguments to the bundled Python tool and inherits standard input/output.
bin/agent-qa.jsView on unpkg · L80Findings
Affected versions and remediation
This report applies to synapse-hub@2.7.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of synapse-hub@2.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.