instabox@0.8.135
A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package provides a cloud-box CLI and associated agent skills. Its credential use is directed to the selected Instabox server, and its disclosed runtime usage telemetry reports command outcomes without arguments and has an opt-out.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; onboarding, skill installation, and move-repo scripts run as part of their corresponding user-directed workflows.
Impact
No malicious impact identified. The disclosed telemetry can be disabled with INSTABOX_NO_TELEMETRY=1 or DO_NOT_TRACK=1.
Mechanism
The CLI sends Instabox credentials to its selected Instabox API server and sends disclosed usage events to PostHog. Skills are copied into agent skill directories, and the move-repo skill's dependency script installs tools when run in the destination box.
AI rationale
The package provides a cloud-box CLI and associated agent skills. Its credential use is directed to the selected Instabox server, and its disclosed runtime usage telemetry reports command outcomes without arguments and has an opt-out.
Evidence
~/.config/instabox/credentials.json~/.config/instabox/telemetry.json~/.claude/skills~/.agents/skills~/.gemini/config/skills
Network endpoints2
api.instabox.shus.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has no install, preinstall, or postinstall hook; its prepack script only copies skills.
- The CLI uses the Instabox API by default and allows the user to configure its server URL.
- Stored credentials are used as bearer tokens for API requests to the selected server.
- Runtime usage telemetry is disclosed as command names and outcomes, with arguments excluded and an opt-out setting.
- Telemetry sends usage events with an Instabox account user ID and routine runtime properties to PostHog; no unrelated credential collection or file-content transfer was identified.
- The move-repo skill describes project transfer and dependency setup as user-directed skill actions.
Evidence against
- The CLI and its skills use network access, read stored Instabox credentials, and write skill or telemetry files when their features run.
- Usage telemetry is enabled by default, but is disclosed and can be disabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggedcli/instabox-windows-arm64.exeView file
•path = cli/instabox-windows-arm64.exe
kind = native_binary
sizeBytes = 9103360
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
cli/instabox-windows-arm64.exeView on unpkgskills/instabox-basic-setup/scripts/install-files.pyView file
•path = skills/instabox-basic-setup/scripts/install-files.py
kind = build_helper
sizeBytes = 2977
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/instabox-basic-setup/scripts/install-files.pyView on unpkgbin/instabox.mjsView file
Findings
1 High5 Medium6 Low
HighPrevious Version Dangerous Deltabin/instabox.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarycli/instabox-windows-arm64.exe
MediumShips Build Helperskills/instabox-basic-setup/scripts/install-files.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/instabox.mjs
Affected versions and remediation
This report applies to instabox@0.8.135.
See all versions of instabox for other recorded verdicts.
- Review the evidence and your use of instabox@0.8.135 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.