instabox
A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest
This report shows the evidence for instabox@0.8.161. 0 of 149 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe package has no npm install hook, and the reviewed CLI behavior aligns with its cloud-box and agent-skill purpose. Its telemetry reports command and outcome data, is disclosed with an opt-out, and sends to its analytics host.
Decision evidence
public snapshot- The package has no install lifecycle hook; its scripts are for packaging, tests, and formatting.
- API bearer tokens are sent to the configured Instabox server as part of the CLI’s service requests.
- Runtime telemetry is disclosed, reports command names and outcomes without arguments, and can be disabled with environment flags.
- The executable installs the package’s agent skills when run; existing user-authored skill files are kept.
Source & flagged code
5 flaggedPackage ships native binary artifacts.
cli/instabox-windows-arm64.exeView on unpkgPackage ships non-JavaScript build or shell helper files.
skills/instabox-basic-setup/scripts/install-files.pyView on unpkgFindings
Affected versions and remediation
This report applies to instabox@0.8.161.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of instabox@0.8.161 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.