registry / sneakoscope / 10.2.0

sneakoscope@10.2.0

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a guarded agent-extension lifecycle risk, not a confirmed malicious install chain. Automatic code execution and incomplete source coverage justify a warning rather than a clean verdict.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs postinstall; setting SKS_POSTINSTALL_BOOTSTRAP=1 enables bootstrap.

Impact

An opted-in install can initialize project or global SKS state; no unconsented broad agent-control mutation was confirmed.

Mechanism

Guarded lifecycle bootstrap and package-state restoration.

AI rationale

This is a guarded agent-extension lifecycle risk, not a confirmed malicious install chain. Automatic code execution and incomplete source coverage justify a warning rather than a clean verdict.

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/command-manifest-lite.jsdist/.sks-build-stamp.json

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

An npm postinstall hook automatically runs the SKS command.
The postinstall handler writes a build stamp inside the installed package.
Opt-in postinstall bootstrap can target a project or global SKS location and forces bootstrap.
The package contains broad Codex and agent-management command surfaces.
Release and fixture helpers can launch shell commands, increasing lifecycle review risk.
A bundled native PDF resource limits complete source-level coverage.

Evidence against

The default postinstall branch returns before external project, home, Codex, or global-state changes.
Broader bootstrap requires SKS_POSTINSTALL_BOOTSTRAP=1.
No runtime dependency on sneakoscope itself is declared.
No credential collection or network exfiltration was confirmed in the inspected postinstall path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

14 flagged

package.jsonView file

Lines 86-126json

86 "runtime:no-src-mjs": "node ./dist/scripts/runtime-no-src-mjs-check.js",

87 "runtime:ts-source-of-truth": "node ./dist/scripts/runtime-ts-source-of-truth-check.js",

88 "architecture:guard": "node ./dist/scripts/architecture-guard-check.js",

89 "runtime:dist-parity": "node ./dist/scripts/runtime-dist-parity-check.js",

90 "release:check": "npm run release:check:affected",

91 "release:metadata": "node ./dist/scripts/release-metadata-check.js",

92 "release:version-truth": "node ./dist/scripts/release-version-truth-check.js",

93 "release:dist-freshness": "node ./dist/scripts/release-dist-freshness-check.js",

94 "release:provenance": "node ./dist/scripts/release-provenance-check.js",

95 "release:gate-script-parity": "node ./dist/scripts/release-gate-script-parity-check.js",

96 "release:file-ownership": "node ./dist/scripts/release-file-ownership-check.js",

97 "release:macos-menubar-proof": "node ./dist/scripts/release-macos-menubar-proof.js",

98 "release:main-push-guard": "node ./dist/scripts/release-main-push-guard.js",

99 "release:main-push-receipt": "node ./dist/scripts/release-main-push-receipt.js",

100 "release:pack-receipt": "node ./dist/scripts/release-pack-receipt.js",

101 "ppt:real-imagegen-wiring": "node ./dist/scripts/ppt-real-imagegen-wiring-check.js",

102 "ux-review:run-wires-imagegen": "node ./dist/scripts/ux-review-run-wires-imagegen-check.js",

103 "typecheck": "tsc -p tsconfig.json --noEmit",

104 "schema:check": "node ./dist/scripts/check-runtime-schemas.js",

105 "secret:preservation-guard": "node ./dist/scripts/secret-preservation-guard-check.js",

106 "postinstall": "node ./dist/bin/sks.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L106

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L106

107 "postinstall:global-doctor-blackbox": "node ./dist/scripts/postinstall-global-doctor-blackbox.js",

108 "doctor:fix-production-blackbox": "node ./dist/scripts/doctor-fix-production-blackbox.js",

109 "doctor:startup-config-repair-blackbox": "node ./dist/scripts/doctor-startup-config-repair-blackbox.js",

110 "doctor:context7-mcp-repair-blackbox": "node ./dist/scripts/doctor-context7-mcp-repair-blackbox.js",

111 "doctor:supabase-mcp-repair-blackbox": "node ./dist/scripts/doctor-supabase-mcp-repair-blackbox.js",

112 "native-capability:postcheck": "node ./dist/scripts/native-capability-postcheck-check.js",

113 "runtime:ts-rust-boundary": "node ./dist/scripts/runtime-ts-rust-boundary-check.js",

114 "codex:permission-profiles": "node ./dist/scripts/codex-permission-profiles-check.js",

115 "mcp:tool-naming-parity": "node ./dist/scripts/mcp-tool-naming-parity-check.js",

116 "runtime:terminal-current": "node ./dist/scripts/runtime-current-terminal-check.js",

117 "codex:project-config-policy-splitter": "node ./dist/scripts/codex-project-config-policy-splitter-check.js",

118 "migration:upgrade-safety": "node ./dist/scripts/current-upgrade-matrix-check.js",

119 "secret:supabase-preservation-blackbox": "node ./dist/scripts/supabase-secret-preservation-blackbox.js",

120 "update:preserves-supabase-keys": "node ./dist/scripts/update-preserves-supabase-keys-blackbox.js",

121 "packcheck": "for d in bin test; do [ -d \"$d\" ] && find \"$d\" -name '*.mjs' -print0; done | xargs -0 -n1 node --check && npm run runtime:no-src-mjs",

122 "changelog:check": "node ./dist/scripts/changelog-check.js",

123 "cli-entrypoint:check": "node ./dist/scripts/check-cli-entrypoint.js",

124 "legacy-free:check": "node ./dist/scripts/check-legacy-free.js",

125 "architecture:check": "node ./dist/scripts/check-architecture.js",

126 "route-modularity:check": "node ./dist/scripts/check-route-modularity.js",

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L34: const actual = createHash('sha256').update(capability).digest(); L35: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L36: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L50: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L51: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L52: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

37const stubBin = path.join(tmp, 'bin'); L38: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L39: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L40: const npmUserConfig = path.join(tmp, 'npmrc'); ... L134: TMPDIR: runtimeTmp, L135: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L136: NODE_DISABLE_COMPILE_CACHE: '1', ... L160: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L161: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L162: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L314: try { L315: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L37

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/cli/command-manifest-lite.jsView file

89Install-time code directly mutates a foreign AI-agent control surface: L89: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L90: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L91: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, Write operation from dist/cli/install-helpers.js: L145: await fsp.access(stamp).catch(async () => { L146: await fsp.writeFile(stamp, `${JSON.stringify(stampLib.buildStampPayload(), null, 2)}\n`); L147: console.log('SKS build stamp: restored inside the installed package for update self-verific

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L89

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/scripts/check-runtime-schemas.jsView file

7const root = process.cwd(); L8: const tsc = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['tsc', '-p', 'tsconfig.json', '--noEmit'], { L9: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/check-runtime-schemas.jsView on unpkg · L7

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/feature-fixture-runner.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/feature-fixture-runner.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical8 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/cli/command-manifest-lite.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighRuntime Package Installdist/scripts/check-runtime-schemas.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/feature-fixture-runner.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

Affected versions and remediation

This report applies to sneakoscope@10.2.0.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 13:10:53.908Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code