registry / skalpel / 3.3.3

skalpel@3.3.3

Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 133 KB of source, external domains: github.com, skalpel.ai

Source & flagged code

4 flagged

package.jsonView file

Lines 11-52json

11 "bugs": {

12 "url": "https://github.com/skalpelai/Skalpelai_Client/issues"

13 },

14 "author": "SkalpelAI Inc.",

15 "keywords": [

16 "coding-agent",

17 "proxy",

18 "tui",

19 "claude",

20 "cursor",

21 "codex"

22 ],

23 "engines": {

24 "node": ">=18"

25 },

26 "bin": {

27 "skalpel": "npm-bin/skalpel.js",

28 "skalpeld": "npm-bin/skalpeld.js"

29 },

30 "scripts": {

31 "preinstall": "node postinstall/preinstall.js",

32 "postinstall": "node postinstall/index.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "preuninstall": "node postinstall/uninstall.js",

34 "test": "node postinstall/lib/run-tests.js && node npm-bin/skalpel.bug-0039.test.js",

35 "test:rc-edit": "node postinstall/lib/rc-edit.test.js",

36 "test:postinstall": "node --test postinstall/index.test.js",

37 "test:preinstall": "node --test postinstall/preinstall.test.js",

38 "test:bug-0039": "node npm-bin/skalpel.bug-0039.test.js"

39 },

40 "files": [

41 "npm-bin/",

42 "postinstall/",

43 "design-tokens.json",

44 "INSTALL.md",

45 "README.md",

46 "LICENSE"

47 ],

48 "dependencies": {

49 "picocolors": "^1.1.1"

50 },

51 "os": [

52 "darwin",

postinstall/preinstall.jsView file

Lines 17-57javascript

17// "ELIFECYCLE" error; the right thing to do when we cannot find or

18// stop the daemon is to log and let the (real) install proceed,

19// because the EBUSY is downstream from us anyway. A fresh install

20// (no prior daemon running) is the common case and we must not break

21// it.

22//

23// History:

24// - BUG-0037 (2026-05-22): added this script after npm upgrade of

25// skalpel 3.1.4→3.1.6 on Windows failed with EBUSY because the

26// v3.1.4 daemon (started by the scheduled task on the previous

27// reboot) held skalpeld.exe open.

postinstall/lib/service-register.jsView file

Lines 1-27javascript

1// Step 3: per-OS service registration.

2//

3// SPEC.md §9.2 (launchd), §9.3 (systemd), §9.4 (Task Scheduler).

4//

5// On every supported OS we:

6// 1. Render the template with paths.templateValues().

7// 2. Write the rendered file to its OS-specific destination.

8// 3. Invoke the OS tool (launchctl / systemctl / schtasks) to load

9// the unit.

10//

11// Idempotence: writing replaces any prior file at the same path.

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node postinstall/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall/preinstall.jsView file

37L38: const { spawnSync } = require('child_process'); L39:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall/preinstall.jsView on unpkg · L37

postinstall/lib/service-register.jsView file

7// 2. Write the rendered file to its OS-specific destination. L8: // 3. Invoke the OS tool (launchctl / systemctl / schtasks) to load L9: // the unit. ... L22: const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: ... L39: // L40: // 2026-05-14 fix: the previous heuristic used `!process.env.DISPLAY` L41: // as a headless signal, but macOS native terminal sessions never set ... L58: function templatePath() { L59: switch (process.platform) { L60: case 'darwin':

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

postinstall/lib/service-register.jsView on unpkg · L7

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirepostinstall/preinstall.js

MediumEnvironment Vars

MediumInstall Persistencepostinstall/lib/service-register.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 11-52json

11 "bugs": {

12 "url": "https://github.com/skalpelai/Skalpelai_Client/issues"

13 },

14 "author": "SkalpelAI Inc.",

15 "keywords": [

16 "coding-agent",

17 "proxy",

18 "tui",

19 "claude",

20 "cursor",

21 "codex"

22 ],

23 "engines": {

24 "node": ">=18"

25 },

26 "bin": {

27 "skalpel": "npm-bin/skalpel.js",

28 "skalpeld": "npm-bin/skalpeld.js"

29 },

30 "scripts": {

31 "preinstall": "node postinstall/preinstall.js",

32 "postinstall": "node postinstall/index.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "preuninstall": "node postinstall/uninstall.js",

34 "test": "node postinstall/lib/run-tests.js && node npm-bin/skalpel.bug-0039.test.js",

35 "test:rc-edit": "node postinstall/lib/rc-edit.test.js",

36 "test:postinstall": "node --test postinstall/index.test.js",

37 "test:preinstall": "node --test postinstall/preinstall.test.js",

38 "test:bug-0039": "node npm-bin/skalpel.bug-0039.test.js"

39 },

40 "files": [

41 "npm-bin/",

42 "postinstall/",

43 "design-tokens.json",

44 "INSTALL.md",

45 "README.md",

46 "LICENSE"

47 ],

48 "dependencies": {

49 "picocolors": "^1.1.1"

50 },

51 "os": [

52 "darwin",

postinstall/preinstall.jsView file

Lines 17-57javascript

17// "ELIFECYCLE" error; the right thing to do when we cannot find or

18// stop the daemon is to log and let the (real) install proceed,

19// because the EBUSY is downstream from us anyway. A fresh install

20// (no prior daemon running) is the common case and we must not break

21// it.

22//

23// History:

24// - BUG-0037 (2026-05-22): added this script after npm upgrade of

25// skalpel 3.1.4→3.1.6 on Windows failed with EBUSY because the

26// v3.1.4 daemon (started by the scheduled task on the previous

27// reboot) held skalpeld.exe open.

postinstall/lib/service-register.jsView file

Lines 1-27javascript

1// Step 3: per-OS service registration.

2//

3// SPEC.md §9.2 (launchd), §9.3 (systemd), §9.4 (Task Scheduler).

4//

5// On every supported OS we:

6// 1. Render the template with paths.templateValues().

7// 2. Write the rendered file to its OS-specific destination.

8// 3. Invoke the OS tool (launchctl / systemctl / schtasks) to load

9// the unit.

10//

11// Idempotence: writing replaces any prior file at the same path.