synapse-hub@2.2.4
Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.
Enterprise AI Agent Intelligence Hub & Autonomous Skill Network
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged launcher runs the CLI engine with the user's supplied arguments, and the update check fetches public version metadata without sending local data. The other inspected flagged files contain security-scanner patterns or local test-triage logic, not concealed payload execution.
Decision evidence
public snapshot- package.json has no lifecycle scripts; its main entry and CLI binaries point to bin/agent-qa.js.
- The launcher passes the user's CLI arguments to the Python tool engine and inherits standard input/output.
- The CLI checks for updates on most commands; the update check requests the package's public version from the npm registry or its GitHub repository.
- The update check uses a 24-hour cache; the inspected shell script scans local JUnit reports and screenshots.
- An update-version request may occur automatically when a CLI subcommand runs.
Source & flagged code
7 flaggedSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/agent-qa.jsView on unpkg · L3The launcher passes the user's CLI arguments to the Python tool engine and inherits standard input/output.
bin/agent-qa.jsView on unpkg · L69Findings
Affected versions and remediation
This report applies to synapse-hub@2.2.4.
See all versions of synapse-hub for other recorded verdicts.
- Review the evidence and your use of synapse-hub@2.2.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.