registry / AI-agent control-surface risk / sneakoscope

sneakoscope

Proof-first Codex CLI and ChatGPT Desktop orchestration for AI coding agents, release verification, and macOS menu bar control.

This report shows the evidence for sneakoscope@6.5.1. 11 of 64 known versions are blocked or flagged. The newest version, 10.6.2, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The lifecycle path concretely modifies broad Codex control surfaces and project hooks/configuration during installation. This meets the blocking policy even though no data-exfiltration chain was confirmed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Alters an existing AI-agent runtime and project agent behavior at dependency-install time.

Mechanism

automatic broad Codex configuration, MCP registration, and hook/skill installation

Policy narrative

`npm install` launches `sks postinstall`, which configures the user's global Codex installation, registers an MCP server, installs global skills, rewrites `~/.codex/config.toml` to enable multiple agent capabilities, and automatically bootstraps the install project. Bootstrap writes Codex configuration, managed hooks, agents, skills, and instruction content. These are broad foreign AI-agent control-surface mutations occurring without an explicit setup command.

AI rationale

Evidence

package.jsondist/bin/sks.jsdist/cli/install-helpers.jsdist/cli/install-helpers-install-support.jsdist/core/codex-runtime/codex-desktop-config-policy.jsdist/core/init.js~/.codex/config.toml~/.agents/skills<installRoot>/.codex/config.toml<installRoot>/.codex/hooks.json<installRoot>/.codex/agents<installRoot>/.agents/skills

Network endpoints1

mcp.context7.com/mcp

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs `dist/bin/sks.js postinstall` on npm install.
dist/cli/install-helpers.js invokes global Codex setup and automatic bootstrap during postinstall.
dist/core/codex-runtime/codex-desktop-config-policy.js rewrites `~/.codex/config.toml`, enabling agent capabilities.
dist/core/init.js writes `.codex/hooks.json`, `.codex/config.toml`, agents, and skills during bootstrap.
dist/cli/install-helpers-install-support.js installs Context7 through `codex mcp add` during postinstall.
dist/core/init.js embeds managed AI-agent instructions for installed projects.

Evidence against

No confirmed credential exfiltration or attacker-owned network endpoint in the inspected lifecycle path.
Process termination and external CLI-tool installation have explicit environment opt-ins.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = parsed.p...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

58return new Promise((resolve) => { L59: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'ignore', 'ignore'], detached: process.platform !== 'win32' }); L60: let timedOut = false;

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L58

dist/core/mad-sks/sql-plane/mcp-executor.jsView file

130async function loadMcpSdk() { L131: const dynamicImport = new Function('specifier', 'return import(specifier)'); L132: const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/mad-sks/sql-plane/mcp-executor.jsView on unpkg · L130

130async function loadMcpSdk() { L131: const dynamicImport = new Function('specifier', 'return import(specifier)'); L132: const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/mad-sks/sql-plane/mcp-executor.jsView on unpkg · L130

dist/core/doctor/doctor-dirty-planner.jsView file

2import path from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L84: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L85: const json = JSON.parse(raw); L86: const proofId = json.proof_id || null; ... L118: if (id.includes('menubar')) L119: return ['src/core/codex-app/sk[redacted]', 'src/commands/doctor.ts', 'package.json']; L120: if (id.includes('skill')) ... L155: const keys = id.includes('supabase') ? ['SUPABASE_ACCESS_TOKEN'] : id.includes('context7') ? ['CONTEXT7_API_KEY'] : []; L156: return Object.fromEntries(keys.map((key) => [key, process.env[key] !== undefined])); L157: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L2

dist/cli/install-helpers-codex-lb-selftest-chain.jsView file

57const chainCalls = []; L58: const okChain = await checkCodexLbResponseChain({ base_url: 'https://lb.example.test/backend-api/codex', env_path: path.join(codexLbHome, '.codex', 'sk[redacted]') }, { L59: apiKey: 'sk-test', ... L61: fetch: async (url, init) => { L62: chainCalls.push({ url, body: JSON.parse(init.body) }); L63: return new Response(JSON.stringify({ id: chainCalls.length === 1 ? 'resp_selftest_1' : 'resp_selftest_2' }), { status: 200, headers: { 'content-type': 'application/json' } }); ... L71: try { L72: globalThis.fetch = async (url, init) => { L73: cacheCalls.push({ url, body: JSON.parse(init.body) });

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/cli/install-helpers-codex-lb-selftest-chain.jsView on unpkg · L57

dist/bin/install.jsView file

1#!/usr/bin/env node L2: const { spawnSync } = require('node:child_process'); L3: const args = process.argv.slice(2); ... L10: if (!['install', 'setup', 'bootstrap'].includes(command)) { L11: console.error('Usage: npx sneakoscope install [--yes|--no-tui]'); L12: process.exit(2);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/install.jsView on unpkg · L1

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = parsed.p...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical5 High7 Medium6 Low

CriticalBuiltin Api Tampering Exfiltrationdist/cli/install-helpers-codex-lb-selftest-chain.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighRuntime Package Installdist/bin/install.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/core/codex/managed-proxy-env.js

MediumDynamic Requiredist/core/mad-sks/sql-plane/mcp-executor.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to sneakoscope@6.5.1.

The versions list below shows the verdict for each recorded version.

Avoid installing sneakoscope@6.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-29 20:09:46.616Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

64 known versions

10.6.2latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 6:11 AM 10.6.1SuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 11:29 AM 10.6.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 11:02 AM 10.5.9Manual Review—AllowUnder ReviewOct 18, 2026, 8:58 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code