registry / sneakoscope / 10.1.5

sneakoscope@10.1.5

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source shows guarded but consequential postinstall mutation of global agent tooling. No concrete theft, destructive action, or unconsented default control-surface mutation was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing with SKS_POSTINSTALL_BOOTSTRAP=1.

Impact

It can change the user's agent extension surface and executable resolution when the opt-in environment flag is supplied.

Mechanism

Postinstall bootstrap registers MCP tooling, installs global skills, and writes SKS command shims.

AI rationale

Inspected source shows guarded but consequential postinstall mutation of global agent tooling. No concrete theft, destructive action, or unconsented default control-surface mutation was established.

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/install-helpers-install-support.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package automatically runs a postinstall command.
With the bootstrap environment flag enabled, installation creates or repairs an SKS executable in PATH directories.
That install branch can register a Context7 MCP server through Codex and runs an unpinned latest npx package.
That install branch can install global Codex skills in the user home directory.

Evidence against

The postinstall handler returns before external changes unless SKS_POSTINSTALL_BOOTSTRAP is explicitly set.
The default branch states that project, home, Codex, and global SKS state are left unchanged.
No credential collection, secret exfiltration, or covert remote payload execution was established from the inspected source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L34: const actual = createHash('sha256').update(capability).digest(); L35: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L36: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L50: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L51: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L52: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

37const stubBin = path.join(tmp, 'bin'); L38: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L39: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L40: const npmUserConfig = path.join(tmp, 'npmrc'); ... L134: TMPDIR: runtimeTmp, L135: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L136: NODE_DISABLE_COMPILE_CACHE: '1', ... L160: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L161: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L162: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L314: try { L315: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L37

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/cli/command-manifest-lite.jsView file

89Install-time code directly mutates a foreign AI-agent control surface: L89: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L90: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L91: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, Write operation from dist/cli/install-helpers.js: L145: await fsp.access(stamp).catch(async () => { L146: await fsp.writeFile(stamp, `${JSON.stringify(stampLib.buildStampPayload(), null, 2)}\n`); L147: console.log('SKS build stamp: restored inside the installed package for update self-verific

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L89

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/scripts/check-runtime-schemas.jsView file

7const root = process.cwd(); L8: const tsc = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['tsc', '-p', 'tsconfig.json', '--noEmit'], { L9: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/check-runtime-schemas.jsView on unpkg · L7

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/feature-fixture-runner.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/feature-fixture-runner.js#virtual:normalized:round1View on unpkg

dist/core/code-structure.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sneakoscope@10.1.3 matchedIdentity = npm:c25lYWtvc2NvcGU:10.1.3 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/code-structure.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

2 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/cli/command-manifest-lite.js

CriticalPrevious Version Dangerous Deltadist/core/code-structure.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighRuntime Package Installdist/scripts/check-runtime-schemas.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/feature-fixture-runner.js#virtual:normalized:round1

Affected versions and remediation

This report applies to sneakoscope@10.1.5.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.1.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 11:53:39.349Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code