registry / skalpel / 4.0.30

skalpel@4.0.30

Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 397 KB of source, external domains: accounts.google.com, cli.skalpel.ai, graph.skalpel.ai, skalpel-prod.auth.us-west-2.amazoncognito.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

2 "name": "skalpel",

3 "version": "4.0.30",

4 "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",

5 "type": "module",

6 "bin": {

7 "skalpel": "skalpel-setup.mjs"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "*.mjs",

14 "README.md"

15 ],

16 "engines": {

17 "node": ">=18"

18 },

19 "keywords": [

20 "claude-code",

21 "codex",

22 "ai",

23 "productivity",

24 "behavioral-analytics"

25 ],

26 "license": "UNLICENSED",

27 "homepage": "https://skalpel.ai"

28}

anchor-shadow.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// anchor-shadow.mjs — ship-status "Auto-Run-the-Anchor", SHADOW mode, READ-ONLY.

3//

4// WHAT: when the user falls into the cycle-12 signature (>=2 consecutive terse re-verify/doubt turns

5// about the SAME claim — "did it merge?", "you sure it's live?", "did that actually push?") AND that

6// doubt is about SHIP STATUS (merged / pushed / live / deployed / price / trial / CI / passing /

7// released), reconstruct the concrete anchor from recent session + repo context (a PR number, a URL,

8// a commit sha, a Stripe price), run ONE read-only allowlisted probe to resolve the doubt, and LOG

9// what we WOULD have injected. It NEVER injects into the live model and NEVER mutates anything.

10//

Lines 1-22javascript

1#!/usr/bin/env node

2// skalpel login — Sign in with Google, fully through AWS (no localhost).

3// this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for

4// the token → save it. The server holds the client secret and does the code exchange; we only ever

5// see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`

6// red block wordmark 1:1. Run: `node skalpel-login.mjs`.

7import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

8import { homedir } from "node:os";

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

anchor-shadow.mjsView file

19// L20: // INJECTION SAFETY: every probe is `execFile(bin, [args...])` — arguments are an array, so there is NO L21: // shell and NO string interpolation. On top of that (defense in depth) every reconstructed value is

High

Child Process

Package source references child process execution.

anchor-shadow.mjsView on unpkg · L19

•matchType = previous_version_dangerous_delta matchedPackage = skalpel@4.0.29 matchedIdentity = npm:c2thbHBlbA:4.0.29 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

anchor-shadow.mjsView on unpkg

2// skalpel login — Sign in with Google, fully through AWS (no localhost). L3: // this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for L4: // the token → save it. The server holds the client secret and does the code exchange; we only ever ... L10: import { randomBytes } from "node:crypto"; L11: import { spawn } from "node:child_process"; L12: L13: const API = process.env.SKALPEL_API || "https://graph.skalpel.ai"; L14: const CLIENT_ID =

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Findings

6 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processanchor-shadow.mjs

HighShell

HighSame File Env Network Executionlogin.mjs

HighSandbox Evasion Gated Capabilitylogin.mjs

HighPrevious Version Dangerous Deltaanchor-shadow.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

2 "name": "skalpel",

3 "version": "4.0.30",

4 "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",

5 "type": "module",

6 "bin": {

7 "skalpel": "skalpel-setup.mjs"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "*.mjs",

14 "README.md"

15 ],

16 "engines": {

17 "node": ">=18"

18 },

19 "keywords": [

20 "claude-code",

21 "codex",

22 "ai",

23 "productivity",

24 "behavioral-analytics"

25 ],

26 "license": "UNLICENSED",

27 "homepage": "https://skalpel.ai"

28}

anchor-shadow.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// anchor-shadow.mjs — ship-status "Auto-Run-the-Anchor", SHADOW mode, READ-ONLY.

3//

4// WHAT: when the user falls into the cycle-12 signature (>=2 consecutive terse re-verify/doubt turns

5// about the SAME claim — "did it merge?", "you sure it's live?", "did that actually push?") AND that

6// doubt is about SHIP STATUS (merged / pushed / live / deployed / price / trial / CI / passing /

7// released), reconstruct the concrete anchor from recent session + repo context (a PR number, a URL,

8// a commit sha, a Stripe price), run ONE read-only allowlisted probe to resolve the doubt, and LOG

9// what we WOULD have injected. It NEVER injects into the live model and NEVER mutates anything.

10//

Lines 1-22javascript

1#!/usr/bin/env node

2// skalpel login — Sign in with Google, fully through AWS (no localhost).

3// this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for

4// the token → save it. The server holds the client secret and does the code exchange; we only ever

5// see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`

6// red block wordmark 1:1. Run: `node skalpel-login.mjs`.

7import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

8import { homedir } from "node:os";