sneakoscope@10.5.5

⚠ Under review

Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The inspected source does not establish malicious behavior, but the required clean citation set exceeds the eight-citation output limit. Manual review is needed to satisfy the remaining source coverage.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; broader setup requires SKS_POSTINSTALL_BOOTSTRAP=1, while menu bar setup requires an eligible macOS install or an explicit override.

Impact

No malicious impact was established from the inspected excerpts.

Mechanism

The handler dispatches to SKS postinstall logic. Its broader setup path is gated, and menu bar installation is separately conditional.

AI rationale

Evidence

package.jsondist/cli/install-helpers.jsdist/cli/install-helpers-menubar.js

Decision evidence

public snapshot

AI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json runs a postinstall command that dispatches to SKS's postinstall handler.
The handler gates broader setup behind an explicit environment opt-in; without it, it returns after the menu bar step.
The menu bar step is limited to interactive global npm installs on macOS, or an explicit environment override.

Evidence against

The required clean review covers 17 distinct paths, but the citation limit is 8; no independent malicious behavior was established in the inspected excerpts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,240 file(s), 9.72 MB of source, external domains: 127.0.0.1, api.openai.com, bridge.invalid, chatgpt.com, developers.google.com, developers.openai.com, docs.getdesign.app, getdesign.md, github.com, invalid.codex-lb.local, lb.example.test, learn.chatgpt.com, llmstxt.org, mcp.context7.com, mcp.example.test, mcp.supabase.com, openrouter.ai, raw.githubusercontent.com, registry.npmjs.org, support.claude.com, www.apple.com, www.npmjs.com, www.sitemaps.org, www.w3.org

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import fsp from 'node:fs/promises';

3import path from 'node:path';

4import os from 'node:os';

5import crypto from

dist/core/release/release-gate-batch-runner.jsView file

60return new Promise((resolve) => { L61: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); L62: let stdoutTail = '';

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L60

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-bridge/server.jsView file

1import { createHash, randomInt, timingSafeEqual } from 'node:crypto'; L2: import http, {} from 'node:http'; L3: import net, {} from 'node:net'; ... L36: const actual = createHash('sha256').update(capability).digest(); L37: const expected = Buffer.from(input.clientCapabilitySha256, 'hex'); L38: if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { ... L52: const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64'); L53: socket.write('HTTP/1.1 101 Switching Protocols\r\n' L54: + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-bridge/server.jsView on unpkg · L1

dist/core/install/installed-package-smoke.jsView file

43const stubBin = path.join(tmp, 'bin'); L44: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L45: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L46: const npmUserConfig = path.join(tmp, 'npmrc'); ... L140: TMPDIR: runtimeTmp, L141: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L142: NODE_DISABLE_COMPILE_CACHE: '1', ... L166: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L167: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L168: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L320: try { L321: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L43

dist/core/daemon/sksd-hook-daemon.jsView file

259const entrypoint = fileURLToPath(new URL('./sk[redacted]', import.meta.url)); L260: const child = spawn(process.execPath, [entrypoint, root], { L261: detached: true, L262: stdio: 'ignore', L263: env: daemonSpawnEnv(process.env) L264: }); ... L274: return new Promise((resolve) => { L275: const socket = net.createConnection(socketPath); L276: let settled = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/daemon/sksd-hook-daemon.jsView on unpkg · L259

dist/core/release/publish-registry-auth.jsView file

1import { spawnSync } from 'node:child_process'; L2: import os from 'node:os'; L3: import path from 'node:path'; L4: export const NPM_REGISTRY = 'https://registry.npmjs.org/'; L5: function npmBinary() { L6: return process.platform === 'win32' ? 'npm.cmd' : 'npm'; L7: } ... L9: const env = {}; L10: for (const [key, value] of Object.entries(process.env)) { L11: if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key)) ... L34: try { L35: const parsed = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/release/publish-registry-auth.jsView on unpkg · L1

dist/cli/command-manifest-lite.jsView file

59Install-time code directly mutates a foreign AI-agent control surface: L72: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L73: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L74: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, ... L376: usage: 'sks memory build [--json] | sks memory gc [--dry-run]', L377: description: 'Project TriWiki context-pack memory into managed AGENTS.md blocks or run bounded memory cleanup.' L378: }, Write operation from dist/core/fsx.js: L107: return; L108: const forbidden = path.join(path.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L59

dist/core/doctor/doctor-dirty-planner.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> dist/bin/sks.js -> dist/bin/sk[redacted] -> dist/cli/main.js -> dist/cli/router.js -> dist/commands/doctor.js -> dist/core/doctor/doctor-dirty-planner.js L3: import path from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js'; ... L89: return { proof_id: null, input_hash: null, repair_applied: false, postcheck_passed: false, postcheck_pending: false }; L90: const json = JSON.parse(raw); L91: const proofId = json.proof_id || null; ... L123: function codexHomeConfigPath() { L124: const codexHome = process.env.CODEX_HOME L125: || path.join(process.env.HOME || os.homedir(), '.codex'); L126: return path.join(codexHome, 'config.toml');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/doctor/doctor-dirty-planner.jsView on unpkg · L3

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1View on unpkg

dist/core/doctor/codex-config-syntax-repair.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sneakoscope@10.5.4 matchedIdentity = npm:c25lYWtvc2NvcGU:10.5.4 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/doctor/codex-config-syntax-repair.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

Findings

1 Critical9 High7 Medium6 Low

CriticalAi Agent Control Hijackdist/cli/command-manifest-lite.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/fsx.js

HighShelldist/core/release/release-gate-batch-runner.js

HighSame File Env Network Executiondist/core/daemon/sksd-hook-daemon.js

HighSandbox Evasion Gated Capabilitydist/core/release/publish-registry-auth.js

HighTrigger Reachable Persistencedist/core/doctor/doctor-dirty-planner.js

HighShips High Entropy Blobdist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdf

HighSemantic Analysis Limiteddist/core/codex-hooks/codex-global-hooks.js#virtual:normalized:round1

HighPrevious Version Dangerous Delta

Affected versions and remediation

This report applies to sneakoscope@10.5.5.

See all versions of sneakoscope for other recorded verdicts.

Review the evidence and your use of sneakoscope@10.5.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 02:56:45.856Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code