registry / AI-agent control-surface risk / skalpel
skalpel
Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.
This report shows the evidence for skalpel@4.0.19. 2 of 39 known versions are blocked or flagged. The newest version, 4.0.54, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, not merely a user-invoked integration. The source establishes transcript access through that installed control path.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install / npm install -g
Impact
Unconsented AI-agent control-surface mutation and access to coding-session transcript content.
Mechanism
postinstall stages runtime and registers a Claude status-line command
Policy narrative
At npm postinstall, the package invokes its installer, copies hook runtime into ~/.skalpel/hooks, and writes a Claude Code statusLine command into ~/.claude/settings.json without an explicit setup command. The registered executable reads Claude transcript content. Its full installer subsequently registers prompt/session hooks and its SessionEnd hook snapshots and uploads complete Claude transcripts to the hosted graph after login.
AI rationale
This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, not merely a user-invoked integration. The source establishes transcript access through that installed control path.
Evidence
package.jsonpostinstall.mjsinstall.mjsskalpel-statusline.mjsincremental-ingest.mjsskalpel-hook.mjs~/.skalpel/hooks/skalpel-statusline.mjs~/.claude/settings.json~/.claude/projects
Network endpoints3
graph.skalpel.aiaccounts.google.com/o/oauth2/v2/authskalpel-prod.auth.us-west-2.amazoncognito.com/oauth2/token
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall.mjs on install.
- postinstall.mjs invokes install.mjs --statusline-only without user confirmation.
- install.mjs stages hook code in ~/.skalpel/hooks and writes ~/.claude/settings.json statusLine.
- The staged statusline reads Claude transcript content from the provided transcript_path.
- Full installation wires Claude/Codex prompt hooks and uploads completed Claude transcripts to graph.skalpel.ai.
Evidence against
- postinstall does not wire prompt/session hooks or modify Codex config.
- Transcript upload path requires a later full install/login and authenticated identity.
- Network destinations are named first-party Skalpel and Google/Cognito endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.mjs || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgautopsy.mjsView file
26// 1. ZERO NETWORK. This file imports ONLY node: core modules (node:fs / node:path / node:os /
L27: // node:readline / node:sqlite). No http/https/net/dns/fetch/child_process. It never opens a socket.
L28: // It only reads local files. `node:sqlite` is a Node core module — it is a local file reader, not a
High
Findings
6 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processautopsy.mjs
HighShell
HighSame File Env Network Executionlogin.mjs
HighSandbox Evasion Gated Capabilitylogin.mjs
HighPrevious Version Dangerous Deltaskalpel-hook.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to skalpel@4.0.19.
The versions list below shows the verdict for each recorded version.
- Avoid installing skalpel@4.0.19. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.