instabox@0.8.91
A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the reviewed network, credential, telemetry, skill-installation, and migration behavior is consistent with the package’s stated purpose. Telemetry is disclosed and can be disabled; the migration skill calls out the sensitive data that may be copied.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Onboarding runs when a user invokes the CLI; repo migration and dependency setup require the user to invoke the corresponding skill workflow.
Impact
No malicious behavior identified. Migration can transfer a token embedded in git configuration, which the skill explicitly discloses.
Mechanism
The CLI authenticates to the configured instabox API, sends disclosed usage telemetry with an opt-out, and can install its own skills. Migration scripts transfer repository data as described by the skill.
AI rationale
The manifest has no lifecycle hooks, and the reviewed network, credential, telemetry, skill-installation, and migration behavior is consistent with the package’s stated purpose. Telemetry is disclosed and can be disabled; the migration skill calls out the sensitive data that may be copied.
Evidence
~/.config/instabox/credentials.json~/.config/instabox/telemetry.json~/.claude/skills~/.agents/skills~/.gemini/config/skills
Network endpoints4
api.instabox.shus.i.posthog.commise.runraw.githubusercontent.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install, preinstall, or postinstall hook.
- The CLI sends its session token as a bearer token to the configured instabox API, which defaults to api.instabox.sh.
- Telemetry is limited to the default instabox server, has an opt-out, and reports usage events with account and random identifiers; the CLI says it excludes names and arguments.
- Onboarding installs the package’s own skills in agent skill directories; the installer preserves skills it did not install.
- The repo-move skill discloses that copied git metadata can include a token embedded in a remote URL and warns that conversation history may contain secrets.
Evidence against
- Running the onboarding command writes skills to user-level agent directories unless --no-skills is supplied; this is the package’s advertised skill-install feature.
- The repo-move skill copies .git, including a token-bearing remote URL if present, as part of preserving the repository; this is disclosed in the skill.
Behavioral surface
ChildProcessCrypto
Source & flagged code
5 flaggedcli/instabox-windows-arm64.exeView file
•path = cli/instabox-windows-arm64.exe
kind = native_binary
sizeBytes = 9008128
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
cli/instabox-windows-arm64.exeView on unpkgskills/instabox-basic-setup/scripts/install-files.pyView file
•path = skills/instabox-basic-setup/scripts/install-files.py
kind = build_helper
sizeBytes = 2977
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/instabox-basic-setup/scripts/install-files.pyView on unpkgbin/instabox.mjsView file
Findings
1 High5 Medium6 Low
HighPrevious Version Dangerous Deltabin/instabox.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarycli/instabox-windows-arm64.exe
MediumShips Build Helperskills/instabox-basic-setup/scripts/install-files.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/api.mjs
Affected versions and remediation
This report applies to instabox@0.8.91.
See all versions of instabox for other recorded verdicts.
- Review the evidence and your use of instabox@0.8.91 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.