registry / skalpel / 3.4.9

skalpel@3.4.9

Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 219 KB of source, external domains: cli.skalpel.ai, github.com, graph.skalpel.ai, skalpel.ai

Source & flagged code

5 flagged

package.jsonView file

Lines 11-51json

11 "bugs": {

12 "url": "https://github.com/skalpelai/Skalpelai_Client/issues"

13 },

14 "author": "SkalpelAI Inc.",

15 "keywords": [

16 "coding-agent",

17 "proxy",

18 "tui",

19 "claude",

20 "cursor",

21 "codex"

22 ],

23 "engines": {

24 "node": ">=18"

25 },

26 "bin": {

27 "skalpel": "npm-bin/skalpel.js",

28 "skalpeld": "npm-bin/skalpeld.js"

29 },

30 "scripts": {

31 "preinstall": "node postinstall/preinstall.js",

32 "postinstall": "node postinstall/index.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

33 "preuninstall": "node postinstall/uninstall.js",

34 "test": "node postinstall/lib/run-tests.js && node npm-bin/skalpel.bug-0039.test.js",

35 "test:rc-edit": "node postinstall/lib/rc-edit.test.js",

36 "test:postinstall": "node --test postinstall/index.test.js",

37 "test:preinstall": "node --test postinstall/preinstall.test.js",

38 "test:bug-0039": "node npm-bin/skalpel.bug-0039.test.js"

39 },

40 "files": [

41 "npm-bin/",

42 "postinstall/",

43 "prosumer-hooks/",

44 "design-tokens.json",

45 "INSTALL.md",

46 "README.md",

47 "LICENSE"

48 ],

49 "dependencies": {

50 "picocolors": "^1.1.1"

51 },

postinstall/preinstall.jsView file

Lines 17-57javascript

17// "ELIFECYCLE" error; the right thing to do when we cannot find or

18// stop the daemon is to log and let the (real) install proceed,

19// because the EBUSY is downstream from us anyway. A fresh install

20// (no prior daemon running) is the common case and we must not break

21// it.

22//

23// History:

24// - BUG-0037 (2026-05-22): added this script after npm upgrade of

25// skalpel 3.1.4→3.1.6 on Windows failed with EBUSY because the

26// v3.1.4 daemon (started by the scheduled task on the previous

postinstall/lib/service-register.jsView file

Lines 1-27javascript

1// Step 3: per-OS service registration.

2//

3// SPEC.md §9.2 (launchd), §9.3 (systemd), §9.4 (Task Scheduler).

4//

5// On every supported OS we:

6// 1. Render the template with paths.templateValues().

7// 2. Write the rendered file to its OS-specific destination.

8// 3. Invoke the OS tool (launchctl / systemctl / schtasks) to load

9// the unit.

10//

prosumer-hooks/bootstrap.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = skalpel@3.4.8 matchedIdentity = npm:c2thbHBlbA:3.4.8 similarity = 0.970 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

prosumer-hooks/bootstrap.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node postinstall/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node postinstall/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall/preinstall.jsView file

37L38: const { spawnSync } = require('child_process'); L39:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall/preinstall.jsView on unpkg · L37

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltaprosumer-hooks/bootstrap.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirepostinstall/preinstall.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepostinstall/lib/service-register.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to skalpel@3.4.9.

See all versions of skalpel for other recorded verdicts.

Review the evidence and your use of skalpel@3.4.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-11 04:57:20.494Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.