synapse-hub@2.4.1
Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.
Enterprise AI Agent Intelligence Hub & Autonomous Skill Network
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no npm install hooks, and the launcher performs work only when invoked as a command. The flagged credential and shell indicators resolve to scanner rules and ordinary example code; no malicious behavior was identified.
Decision evidence
public snapshot- package.json declares CLI scripts but no install lifecycle scripts.
- The launcher forwards user-supplied arguments to the Python CLI and inherits standard I/O.
- Importing the launcher exports resolvePython without calling main.
- skillspector.py defines the AWS credential path as a pattern its scanner detects.
- The scanner reads files from its selected target for analysis.
- The launcher starts a Python process when its CLI is invoked and passes through the current environment.
- skillspector.py can write a report when the user supplies an output path.
Source & flagged code
6 flaggedSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/agent-qa.jsView on unpkg · L3This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/agent-qa.jsView on unpkgFindings
Affected versions and remediation
This report applies to synapse-hub@2.4.1.
See all versions of synapse-hub for other recorded verdicts.
- Review the evidence and your use of synapse-hub@2.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.