Loading npm security reports…

skalpel@4.0.19: AI-agent control-surface risk | LPM Firewall

registry / skalpel / 4.0.19

skalpel@4.0.19

Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently modifies the foreign Claude Code configuration to execute package-staged code as its status line. That code reads Claude transcript data; a later user command expands this into prompt hooks and transcript upload.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install / npm install -g

Impact

Unconsented AI-agent control-surface mutation and access to coding-session transcript content.

Mechanism

postinstall stages runtime and registers a Claude status-line command

Policy narrative

At npm postinstall, the package invokes its installer, copies hook runtime into ~/.skalpel/hooks, and writes a Claude Code statusLine command into ~/.claude/settings.json without an explicit setup command. The registered executable reads Claude transcript content. Its full installer subsequently registers prompt/session hooks and its SessionEnd hook snapshots and uploads complete Claude transcripts to the hosted graph after login.

Rationale

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, not merely a user-invoked integration. The source establishes transcript access through that installed control path.

Evidence

package.jsonpostinstall.mjsinstall.mjsskalpel-statusline.mjsincremental-ingest.mjsskalpel-hook.mjs~/.skalpel/hooks/skalpel-statusline.mjs~/.claude/settings.json~/.claude/projects

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

autopsy.mjsView file

26// 1. ZERO NETWORK. This file imports ONLY node: core modules (node:fs / node:path / node:os / L27: // node:readline / node:sqlite). No http/https/net/dns/fetch/child_process. It never opens a socket. L28: // It only reads local files. `node:sqlite` is a Node core module — it is a local file reader, not a

High

Child Process

Package source references child process execution.

autopsy.mjsView on unpkg · L26

login.mjsView file

2// skalpel login — Sign in with Google, fully through AWS (no localhost). L3: // this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for L4: // the token → save it. The server holds the client secret and does the code exchange; we only ever ... L10: import { randomBytes } from "node:crypto"; L11: import { spawn } from "node:child_process"; L12: L13: const API = process.env.SKALPEL_API || "https://graph.skalpel.ai"; L14: const CLIENT_ID =

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

login.mjsView on unpkg · L2

2// skalpel login — Sign in with Google, fully through AWS (no localhost). L3: // this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for L4: // the token → save it. The server holds the client secret and does the code exchange; we only ever ... L10: import { randomBytes } from "node:crypto"; L11: import { spawn } from "node:child_process"; L12: L13: const API = process.env.SKALPEL_API || "https://graph.skalpel.ai"; L14: const CLIENT_ID = ... L25: X = "\x1b[0m"; L26: const isTTY = process.stdout.isTTY && !process.env.CI; L27: ... L44: return join(

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

login.mjsView on unpkg · L2

skalpel-hook.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = skalpel@4.0.8 matchedIdentity = npm:c2thbHBlbA:4.0.8 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skalpel-hook.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "skalpel",

3 "version": "4.0.19",

4 "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",

5 "type": "module",

6 "bin": {

7 "skalpel": "skalpel-setup.mjs"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "*.mjs",

14 "README.md"

15 ],

16 "engines": {

17 "node": ">=18"

18 },

19 "keywords": [

20 "claude-code",

21 "codex",

22 "ai",

23 "productivity",

24 "behavioral-analytics"

25 ],

26 "license": "UNLICENSED",

27 "homepage": "https://skalpel.ai"

28}

29

autopsy.mjsView file

Lines 6-46javascript

6// are ALREADY on this machine, across EVERY local agent it can find — and renders a plain-text,

7// screenshot-native receipt of VERIFIED behavioral relations. Every number it prints re-derives exactly

8// from the raw logs of the vendor it came from: each relation quotes the user's own lines VERBATIM with

9// {session,turn,ts,tool} citations and a `reproduce:` line that re-opens the cited store FRESH from disk

10// and re-confirms the count — PER VENDOR.

11//

12// VENDORS READ (all local, read-only):

13// • Claude Code — ~/.claude/projects/**/*.jsonl (top-level interactive sessions)

14// • Codex — ~/.codex/{sessions,archived_sessions}/**/rollout-*.jsonl

15

login.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// skalpel login — Sign in with Google, fully through AWS (no localhost).

3// this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for

4// the token → save it. The server holds the client secret and does the code exchange; we only ever

5// see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`

6// red block wordmark 1:1. Run: `node skalpel-login.mjs`.

7import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

8import { homedir }

skalpel-hook.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = skalpel@4.0.8 matchedIdentity = npm:c2thbHBlbA:4.0.8 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skalpel-hook.mjsView on unpkg