registry / synapse-hub / 2.4.2

synapse-hub@2.4.2

Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.

Enterprise AI Agent Intelligence Hub & Autonomous Skill Network

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The launcher dispatches user-supplied CLI commands and does not execute on import, while package.json declares no install hook. The flagged AWS references are detection patterns, and the Playwright example targets a local project server.

Static reason

One or more suspicious static signals were detected.

Trigger

The CLI runs only when invoked; importing its entry point does not start it.

Impact

No malicious impact was identified from the reviewed source.

Mechanism

The launcher forwards the requested arguments to the package's Python CLI. Reviewed scanner patterns describe checks performed by the tool, not credential collection or exfiltration.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exposes a Python CLI through bin/agent-qa.js, with no install lifecycle script declared in package.json.
Importing the launcher does not run its CLI; main() runs only when the file is executed directly.
The AWS-related matches in tools/skillspector.py are regular-expression rules for detecting risky patterns, not credential reads or network requests.
The Playwright example launches a project-local development server and checks localhost when explicitly run.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 37.7 KB of source, external domains: crm-demo.enterprise.local, staging-shop.example.com, www.python.org

Source & flagged code

6 flagged

bin/agent-qa.jsView file

3// SPDX-License-Identifier: MIT L4: // Project: Synapse-Hub (https://github.com/TeeVee998/Synapse-Hub) L5: ... L12: L13: const { spawn, execFileSync } = require('child_process'); L14: const path = require('path'); ... L16: L17: const REPO_ROOT = path.resolve(__dirname, '..'); L18: const CLI_PATH = path.join(REPO_ROOT, 'tools', 'cli.py'); ... L31: function resolvePython() { L32: const candidates = process.platform === 'win32' L33: ? ['python', 'py', 'python3']

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/agent-qa.jsView on unpkg · L3

102if (require.main === module) { main(); } else { module.exports = { resolvePython }; }

Low

Ai Review Evidence

Importing the launcher does not run its CLI; main() runs only when the file is executed directly.

bin/agent-qa.jsView on unpkg · L102

tools/tms_sync_bridge.pyView file

•

Findings

2 High3 Medium7 Low

HighSandbox Evasion Gated Capabilitybin/agent-qa.js

HighPayload In Excluded Dir.agents/skills/playwright-webapp-testing/examples/server_lifecycle_playwright.py

MediumEnvironment Vars

MediumShips Build Helpertools/tms_sync_bridge.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/agent-qa.js

LowAi Review Evidencetools/skillspector.py

Affected versions and remediation

This report applies to synapse-hub@2.4.2.

See all versions of synapse-hub for other recorded verdicts.

Review the evidence and your use of synapse-hub@2.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-03 10:34:13.693Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / synapse-hub / 2.4.2

synapse-hub@2.4.2

Phien ban cu da duoc thu hoi. Vui long nang cap len synapse-hub@3.0.1 de su dung day du 51 skills va cac ban va bao mat moi nhat.

Enterprise AI Agent Intelligence Hub & Autonomous Skill Network

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

The CLI runs only when invoked; importing its entry point does not start it.

Impact

No malicious impact was identified from the reviewed source.

Mechanism

The launcher forwards the requested arguments to the package's Python CLI. Reviewed scanner patterns describe checks performed by the tool, not credential collection or exfiltration.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exposes a Python CLI through bin/agent-qa.js, with no install lifecycle script declared in package.json.
Importing the launcher does not run its CLI; main() runs only when the file is executed directly.
The AWS-related matches in tools/skillspector.py are regular-expression rules for detecting risky patterns, not credential reads or network requests.
The Playwright example launches a project-local development server and checks localhost when explicitly run.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 37.7 KB of source, external domains: crm-demo.enterprise.local, staging-shop.example.com, www.python.org

Source & flagged code

6 flagged

bin/agent-qa.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/agent-qa.jsView on unpkg · L3

102if (require.main === module) { main(); } else { module.exports = { resolvePython }; }

Low

Ai Review Evidence

Importing the launcher does not run its CLI; main() runs only when the file is executed directly.

bin/agent-qa.jsView on unpkg · L102

tools/tms_sync_bridge.pyView file

•

Findings

2 High3 Medium7 Low

HighSandbox Evasion Gated Capabilitybin/agent-qa.js

HighPayload In Excluded Dir.agents/skills/playwright-webapp-testing/examples/server_lifecycle_playwright.py

MediumEnvironment Vars

MediumShips Build Helpertools/tms_sync_bridge.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/agent-qa.js

LowAi Review Evidencetools/skillspector.py

Affected versions and remediation

This report applies to synapse-hub@2.4.2.

See all versions of synapse-hub for other recorded verdicts.

Review the evidence and your use of synapse-hub@2.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-03 10:34:13.693Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.