registry / sneakoscope / 10.5.4

sneakoscope@10.5.4

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Source supports a warning for guarded agent extension setup and a changing upstream MCP dependency. The explicit lifecycle gate does not support blocking for unconsented agent control mutation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation with SKS_POSTINSTALL_BOOTSTRAP=1 and without SKS_POSTINSTALL_NO_BOOTSTRAP=1.

Impact

Agent behavior changes through installed skills and an MCP extension whose future resolved release can change.

Mechanism

The lifecycle reconciles global skills with writes enabled and registers an MCP command that resolves an upstream package using latest.

AI rationale

Source supports a warning for guarded agent extension setup and a changing upstream MCP dependency. The explicit lifecycle gate does not support blocking for unconsented agent control mutation.

Evidence

package.jsondist/core/commands/basic-cli.jsdist/cli/install-helpers.jsdist/cli/install-helpers-install-support.jsdist/core/init/skills.js.agents/skills

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json automatically invokes the postinstall command, which loads the install helper.
External agent setup requires SKS_POSTINSTALL_BOOTSTRAP=1 and is disabled by SKS_POSTINSTALL_NO_BOOTSTRAP=1.
The opted-in lifecycle calls the global skill installer, which reconciles the user's .agents/skills directory with writes enabled.
The same opted-in setup registers Context7 through Codex using @upstash/context7-mcp@latest, allowing later launches to resolve changing upstream releases.

Evidence against

The inspected lifecycle gate prevents default installation from reaching these agent setup operations.
No covert credential export or malicious payload execution was established in the inspected setup chain.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L36: const actual = createHash('sha256').update(capability).digest(); L37: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L38: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L52: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L53: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L54: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

43const stubBin = path.join(tmp, 'bin'); L44: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L45: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L46: const npmUserConfig = path.join(tmp, 'npmrc'); ... L140: TMPDIR: runtimeTmp, L141: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L142: NODE_DISABLE_COMPILE_CACHE: '1', ... L166: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L167: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L168: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L320: try { L321: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L43

dist/core/daemon/sksd-hook-daemon.jsView file

259const entrypoint = fileURLToPath(new URL('./sk[redacted]', import.meta.url)); L260: const child = spawn(process.execPath, [entrypoint, root], { L261: detached: true, L262: stdio: 'ignore', L263: env: daemonSpawnEnv(process.env) L264: }); ... L274: return new Promise((resolve) => { L275: const socket = net.createConnection(socketPath); L276: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg · L259

•matchType = previous_version_dangerous_delta matchedPackage = sneakoscope@10.5.1 matchedIdentity = npm:c25lYWtvc2NvcGU:10.5.1 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/cli/command-manifest-lite.jsView file

59Install-time code directly mutates a foreign AI-agent control surface: L72: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L73: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L74: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, ... L376: usage: 'sks memory build [--json] | sks memory gc [--dry-run]', L377: description: 'Project TriWiki context-pack memory into managed AGENTS.md blocks or run bounded memory cleanup.' L378: }, Write operation from dist/core/fsx.js: L107: return; L108: const forbidden = path.join(path.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L59

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical9 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/cli/command-manifest-lite.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSame File Env Network Executiondist/core/daemon/sksd-hook-daemon.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1

HighPrevious Version Dangerous Delta

Affected versions and remediation

This report applies to sneakoscope@10.5.4.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.5.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-06 21:00:53.854Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code