registry / synapse-hub / 2.1.1
synapse-hub@2.1.1
Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.
Enterprise AI Agent Intelligence Hub & Autonomous Skill Network
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe launcher dispatches requested commands, and the flagged helper performs local report and screenshot inspection. Project writes and TMS requests are tied to explicit setup or configured integration behavior; no malicious activity was found.
Static reason
One or more suspicious static signals were detected.
Trigger
The launcher runs when invoked; project setup and live TMS actions require the corresponding command or integration call.
Impact
No unauthorized collection, external transfer, or other malicious behavior was identified in the reviewed paths.
Mechanism
The launcher dispatches arguments to the Python CLI. Setup writes project files and a Git hook when explicitly requested; live TMS requests target a configured service URL.
AI rationale
The launcher dispatches requested commands, and the flagged helper performs local report and screenshot inspection. Project writes and TMS requests are tied to explicit setup or configured integration behavior; no malicious activity was found.
Evidence
Target project's PROJECT_AI_GUIDE.mdTarget project's .git/hooks/pre-push
Network endpoints1
mock-alm.enterprise.local (mock default; live requests use configured JIRA_URL or TESTRAIL_URL)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest routes the CLI names to bin/agent-qa.js and declares no install lifecycle hooks.
- The launcher forwards the supplied command-line arguments to the package's Python CLI.
- Project setup is an explicit CLI subcommand; it creates project guidance and a pre-push hook when requested.
- The TMS bridge uses a mock endpoint by default or a URL configured for Jira or TestRail, and its live requests use that endpoint.
- The flagged shell helper searches local JUnit reports and screenshot filenames.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
7 flaggedbin/agent-qa.jsView file
8L9: const { spawn, execSync } = require('child_process');
L10: const path = require('path');
...
L12:
L13: const REPO_ROOT = path.resolve(__dirname, '..');
L14: const CLI_PATH = path.join(REPO_ROOT, 'tools', 'cli.py');
...
L27: function resolvePython() {
L28: const candidates = process.platform === 'win32'
L29: ? ['python', 'py', 'python3']
...
L55: console.error(`Neither ${CYAN}python3${RESET} nor ${CYAN}python${RESET} (>= 3.9) was found on your PATH.`);
L56: console.error(`👉 Please install Python from: ${BOLD}https://www.python.org/downloads/${RESET}\n`);
L57: process.exit(1);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/agent-qa.jsView on unpkg · L865const args = [CLI_PATH, ...process.argv.slice(2)];
// Spawn child Python process inheriting standard IO
const child = spawn(python.command, args, {
stdio: 'inherit',
Low
Ai Review Evidence
The launcher forwards the supplied command-line arguments to the package's Python CLI.
bin/agent-qa.jsView on unpkg · L65tools/tms_sync_bridge.pyView file
Findings
2 High3 Medium7 Low
HighSandbox Evasion Gated Capabilitybin/agent-qa.js
HighPayload In Excluded Dir.agents/skills/failure-autopsy-and-healing/scripts/triage_failures.sh
MediumEnvironment Vars
MediumShips Build Helpertools/tms_sync_bridge.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/agent-qa.js
LowAi Review Evidencetools/cli.py
Affected versions and remediation
This report applies to synapse-hub@2.1.1.
See all versions of synapse-hub for other recorded verdicts.
- Review the evidence and your use of synapse-hub@2.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.