registry / synthesisui / 0.3.0

synthesisui@0.3.0

Traz design systems do SynthesisUI para qualquer projeto (materializa em _local/ds/).

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User explicitly runs `synthesisui add <slug>` or `synthesisui init --ds <slug>`.

Impact

A downloaded design system can influence future Claude-agent behavior through a marked managed block in the project CLAUDE.md.

Mechanism

Explicit CLI agent-instruction and design-artifact materialization.

Rationale

This is a real, explicit-user-command mutation of a project AI-agent instruction file, so it warrants a warning under policy. Source inspection found no stealth, lifecycle-triggered behavior, exfiltration, or destructive chain.

Evidence

package.jsondist/commands/add.jsdist/claude-md.jsdist/commands/init.jsdist/registry.jsCLAUDE.md_synthesisui/config.json_synthesisui/ds/<slug>/

Network endpoints3

www.synthesisui.com/api/registry/dswww.synthesisui.com/api/ai/advisorwww.synthesisui.com/api/ai/generate

synthesisui@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code