{"_id":"@aissabelkoussa/cupel","_rev":"7-5291cef0168b729c54444268016aa149","name":"@aissabelkoussa/cupel","dist-tags":{"latest":"0.3.3"},"versions":{"0.3.1":{"name":"@aissabelkoussa/cupel","version":"0.3.1","keywords":["claude-code","cursor","codex","ai","skills","security","audit","prompt-injection","supply-chain","cli"],"author":{"name":"Aïssa BELKOUSSA","email":"contact@aissabelkoussa.fr"},"license":"MIT","_id":"@aissabelkoussa/cupel@0.3.1","maintainers":[{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"}],"homepage":"https://aissabelkoussa.fr/cupel","bugs":{"url":"https://github.com/aissablk1/cupel/issues"},"bin":{"cupel":"bin/cupel.mjs"},"dist":{"shasum":"30d0b6003ce8dbb35e25c9860408ab5c96d82d56","tarball":"https://registry.npmjs.org/@aissabelkoussa/cupel/-/cupel-0.3.1.tgz","fileCount":7,"integrity":"sha512-mfg9qfBJcNxEiIhK9Zt/xG2yt5/C3tH9SPgez/qWyKwYiNUgszfFBBuRxN5pB17EBmS5AoQlshjQVqC0gnM4GQ==","signatures":[{"sig":"MEYCIQDyVzQ2Ql21Qltyj/3wFRO8aW6UlBzvErFYJw8s+SdSkgIhAPG9G3XGup8f1Hx+Fe21sGnPUMpUBoZxHQYlPSoWjEFS","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":112890},"type":"module","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"45c3ba89395c4519eeccaab39133a6258ff46842","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"},"deprecated":"Broken — workspace:* dep leaked into the tarball. Use 0.3.2+","repository":{"url":"git+https://github.com/aissablk1/cupel.git","type":"git","directory":"packages/cli"},"_npmVersion":"10.9.4","description":"Cupel — audit local des skills IA (Claude Code, Cursor, Codex). 14 règles de détection : prompt injection, ASCII smuggling, tool poisoning, exfiltration credentials, reverse shells, obfuscation hex. Zero network. Inspiré de la coupelle de l'essayeur d'or,","directories":{},"_nodeVersion":"22.22.1","dependencies":{"ora":"^8.1.0","tar":"^7.4.3","zod":"^3.23.8","conf":"^13.0.1","open":"^10.1.0","chalk":"^5.3.0","yauzl":"^3.1.3","undici":"^6.20.0","inquirer":"^11.0.2","commander":"^12.1.0","@cupel/shared":"workspace:*"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","vitest":"^2.1.2","typescript":"^5.6.2","@types/node":"^22.7.4","@types/yauzl":"^2.10.3","@types/inquirer":"^9.0.7"},"_npmOperationalInternal":{"tmp":"tmp/cupel_0.3.1_1779118239363_0.46162797935245314","host":"s3://npm-registry-packages-npm-production"}},"0.3.2":{"name":"@aissabelkoussa/cupel","version":"0.3.2","keywords":["claude-code","cursor","codex","ai","skills","security","audit","prompt-injection","supply-chain","cli"],"author":{"name":"Aïssa BELKOUSSA","email":"contact@aissabelkoussa.fr"},"license":"MIT","_id":"@aissabelkoussa/cupel@0.3.2","maintainers":[{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"}],"homepage":"https://aissabelkoussa.fr/cupel","bugs":{"url":"https://github.com/aissablk1/cupel/issues"},"bin":{"cupel":"bin/cupel.mjs"},"dist":{"shasum":"b046a4715d864e81afc97fb8b38da9f3d9565535","tarball":"https://registry.npmjs.org/@aissabelkoussa/cupel/-/cupel-0.3.2.tgz","fileCount":7,"integrity":"sha512-JvFP9A6qgEjo1Fm34Ikh2UgmoyGcDSRjN7HO6kqHKJpRGYrGuCrgYwF+W1tiDts7Xa6ZPmHUdVebamz1NHyCvg==","signatures":[{"sig":"MEYCIQCfTm/cwnXcEUQRnITliYCSC+b6SgzqtdAfBR0lStp/1QIhAN/b2c20LYgftEm7wlOVbArkvgfgXSoJvvj3GgQFWs36","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":112854},"type":"module","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"45c3ba89395c4519eeccaab39133a6258ff46842","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit"},"_npmUser":{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"},"deprecated":"Too many false positives on tool_poisoning rule — use 0.3.3+","repository":{"url":"git+https://github.com/aissablk1/cupel.git","type":"git","directory":"packages/cli"},"_npmVersion":"10.9.4","description":"Cupel — audit local des skills IA (Claude Code, Cursor, Codex). 14 règles de détection : prompt injection, ASCII smuggling, tool poisoning, exfiltration credentials, reverse shells, obfuscation hex. Zero network. Inspiré de la coupelle de l'essayeur d'or,","directories":{},"_nodeVersion":"22.22.1","dependencies":{"ora":"^8.1.0","tar":"^7.4.3","zod":"^3.23.8","conf":"^13.0.1","open":"^10.1.0","chalk":"^5.3.0","yauzl":"^3.1.3","undici":"^6.20.0","inquirer":"^11.0.2","commander":"^12.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.0","vitest":"^2.1.2","typescript":"^5.6.2","@types/node":"^22.7.4","@types/yauzl":"^2.10.3","@types/inquirer":"^9.0.7"},"_npmOperationalInternal":{"tmp":"tmp/cupel_0.3.2_1779120377775_0.8123184561899432","host":"s3://npm-registry-packages-npm-production"}},"0.3.3":{"name":"@aissabelkoussa/cupel","version":"0.3.3","description":"Cupel — audit local des skills IA (Claude Code, Cursor, Codex). 14 règles de détection : prompt injection, ASCII smuggling, tool poisoning, exfiltration credentials, reverse shells, obfuscation hex. Zero network. Inspiré de la coupelle de l'essayeur d'or,","author":{"name":"Aïssa BELKOUSSA","email":"contact@aissabelkoussa.fr"},"license":"MIT","type":"module","homepage":"https://aissabelkoussa.fr/cupel","repository":{"type":"git","url":"git+https://github.com/aissablk1/cupel.git","directory":"packages/cli"},"bin":{"cupel":"bin/cupel.mjs"},"exports":{".":{"import":"./dist/index.js","types":"./dist/index.d.ts"}},"scripts":{"build":"tsup","dev":"tsup --watch","test":"vitest run","typecheck":"tsc --noEmit"},"dependencies":{"chalk":"^5.3.0","commander":"^12.1.0","conf":"^13.0.1","inquirer":"^11.0.2","open":"^10.1.0","ora":"^8.1.0","tar":"^7.4.3","undici":"^6.20.0","yauzl":"^3.1.3","zod":"^3.23.8"},"devDependencies":{"@types/inquirer":"^9.0.7","@types/yauzl":"^2.10.3","@types/node":"^22.7.4","tsup":"^8.3.0","typescript":"^5.6.2","vitest":"^2.1.2"},"engines":{"node":">=22.0.0"},"keywords":["claude-code","cursor","codex","ai","skills","security","audit","prompt-injection","supply-chain","cli"],"publishConfig":{"access":"public"},"_id":"@aissabelkoussa/cupel@0.3.3","gitHead":"92c1eba1e55acdcfb5688545298f13c14b999efa","bugs":{"url":"https://github.com/aissablk1/cupel/issues"},"_nodeVersion":"22.22.1","_npmVersion":"10.9.4","dist":{"integrity":"sha512-OokFK5P/uZUbvvaxCOiaTKpSuv+gg3FYMh71u+yeE0zahYco6j4SfwJ3uvua8OO8lPjs/B5n31vkmAweqLCk7Q==","shasum":"6ffaa6a593346bc7f23c76c108dc1e0161b26319","tarball":"https://registry.npmjs.org/@aissabelkoussa/cupel/-/cupel-0.3.3.tgz","fileCount":7,"unpackedSize":113478,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCGiofVm7cjjbS0rvS2zynuWKCnUGFMHXrnuzm6Jtn23AIhAL3dfnFPlHtdnJzJGVhrRIk1mbMRh737EGW83d9Xfw9O"}]},"_npmUser":{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"},"directories":{},"maintainers":[{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cupel_0.3.3_1779121112817_0.7117051614475463"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-18T15:30:39.295Z","modified":"2026-05-18T16:18:33.115Z","0.3.1":"2026-05-18T15:30:39.514Z","0.3.2":"2026-05-18T16:06:17.938Z","0.3.3":"2026-05-18T16:18:33.010Z"},"bugs":{"url":"https://github.com/aissablk1/cupel/issues"},"author":{"name":"Aïssa BELKOUSSA","email":"contact@aissabelkoussa.fr"},"license":"MIT","homepage":"https://aissabelkoussa.fr/cupel","keywords":["claude-code","cursor","codex","ai","skills","security","audit","prompt-injection","supply-chain","cli"],"repository":{"type":"git","url":"git+https://github.com/aissablk1/cupel.git","directory":"packages/cli"},"description":"Cupel — audit local des skills IA (Claude Code, Cursor, Codex). 14 règles de détection : prompt injection, ASCII smuggling, tool poisoning, exfiltration credentials, reverse shells, obfuscation hex. Zero network. Inspiré de la coupelle de l'essayeur d'or,","maintainers":[{"name":"aissabelkoussa","email":"contact@aissabelkoussa.fr"}],"readme":"# cupel\n\n> Audit local des skills IA. Sépare le métal pur des impuretés.\n\n```bash\nnpx cupel\n```\n\nScanne en quelques secondes les skills installés pour **Claude Code, Cursor, Codex, Windsurf, Gemini CLI, GitHub Copilot CLI, Continue**. Détecte les prompt injections, les exfiltrations de credentials, les reverse shells, les `curl | bash`, les signatures absentes, les skills stales. **Zero network. Tout reste sur ta machine.**\n\n---\n\n## Pourquoi « cupel » ?\n\nAvant que les startups inventent les scans cybersécurité, les **orfèvres** avaient déjà un outil pour distinguer le vrai or du faux. Ça s'appelle une **coupelle** — en anglais, *cupel*.\n\nOn y dépose l'échantillon de métal, on chauffe à 1000 °C, et la céramique poreuse absorbe les impuretés (plomb, scories, alliages parasites). Le métal pur reste, isolé, visible.\n\n`cupel` fait exactement ça pour tes skills IA. Tu lances le scan, l'outil chauffe — les impuretés (prompt injection, exfiltration, reverse shells) ressortent, le pur reste lisible.\n\n---\n\n## Usage\n\n```bash\n# Zéro install — usage immédiat\nnpx cupel\n\n# Sortie JSON pour CI/pipeline\nnpx @aissabelkoussa/cupel --json\n\n# Échec du pipeline si un skill est en tier danger\nnpx @aissabelkoussa/cupel --strict\n\n# Détail complet, même sur les skills propres\nnpx @aissabelkoussa/cupel --verbose\n\n# Cibler un dossier précis\nnpx @aissabelkoussa/cupel --path ~/.config/cursor/skills\n```\n\nPrérequis : **Node.js ≥ 22**.\n\n---\n\n## Ce que cupel détecte\n\n11 catégories de signaux, scoring composite, tier final `ok / warn / danger` :\n\n| Signal | Exemple |\n|---|---|\n| `shell_pipe_to_interpreter` | `curl https://x.io/y.sh \\| bash` |\n| `reverse_shell_tcp` | `/dev/tcp/10.0.0.1/4444` |\n| `rm_rf_root` | `rm -rf $HOME` |\n| `prompt_injection` | « ignore all previous instructions » (FR + EN) |\n| `cred_file_read` | `cat ~/.ssh/id_rsa`, `~/.aws/credentials` |\n| `credential_pattern` | clés AWS/Stripe/OpenAI en clair (exclusion `EXAMPLE`, `YOUR_`, `XXXX`) |\n| `webhook_exfil` | endpoints connus (`webhook.site`, ngrok, requestbin) |\n| `powershell_iwr_iex` | `iwr https://x | iex` |\n| `no_manifest` | pas de SKILL.md / README.md / manifest.json |\n| `unsigned` | aucune signature ed25519 / `.cupel-sig` |\n| `stale` | dernière modif il y a plus de 365 jours |\n\nLes installeurs trusted (`sh.rustup.rs`, `nodejs.org`, etc.) sont reconnus et leur poids divisé par 2 — pour éviter les faux positifs sur les setups légitimes.\n\nDétails complets des règles : [code source `src/commands/doctor.ts`](https://github.com/aissablk1/cupel/blob/main/packages/cli/src/commands/doctor.ts).\n\n---\n\n## Sortie\n\n```\n  Inventaire skills — audit local\n\n  ○ 12 sûrs    ◐ 4 à vérifier    ● 2 risque\n\n  Claude Code  (10)\n    ● skill-productivity-pro          score  75   8 fichiers · 12.4 KiB · home\n        · cred_file_read (+40) — install.sh — cat ~/.ssh/id_rsa | base64\n        · webhook_exfil (+30) — README.md — https://webhook.site/abcd1234\n    ◐ awesome-prompt-helper           score  35   3 fichiers · 4.1 KiB · home\n        · prompt_injection (+25) — SKILL.md — « ignore previous instructions »\n    ○ ts-strict                       score   0   2 fichiers · 1.8 KiB · home\n    …\n\n  ⚠ 2 skills à inspecter sans tarder.\n     Vérifie le contenu, supprime via `cupel remove <slug>` si compromis.\n\n  ─────────────────────────────────────────────────────────\n  Audit async par Aïssa BELKOUSSA — 590€ (rapport PDF + Loom + politique CI, livré J+5)\n  → https://aissabelkoussa.fr/cupel\n```\n\n---\n\n## CI / pipelines\n\nExit codes :\n\n- `0` — aucun risque détecté (en `--strict` : tier ≠ danger)\n- `1` — erreur d'exécution (chemin invalide, permissions)\n- `2` — au moins un skill en tier `danger` (`--strict` activé)\n\nIntégration GitHub Actions :\n\n```yaml\n- name: Cupel — audit skills IA\n  run: npx @aissabelkoussa/cupel --strict --json > cupel-report.json\n```\n\n---\n\n## Plateformes scannées automatiquement\n\n- `~/.claude/skills/`\n- `~/.config/cursor/skills/`\n- `~/.codex/skills/`\n- `~/.config/windsurf/skills/`\n- `~/.gemini/skills/`\n- `~/.continue/skills/`\n- `~/.config/github-copilot-cli/skills/`\n- Le dossier courant (et sous-dossiers `skills/`) du projet\n\n---\n\n## Audit manuel\n\nLe CLI te dit **ce qui** cloche. Pour comprendre *pourquoi* certains signaux remontent sur ton stack et *comment réparer* sans casser tes workflows, un audit manuel est disponible :\n\n→ **[aissabelkoussa.fr/cupel](https://aissabelkoussa.fr/cupel)** — diagnostic 30 min gratuit, audit async 590 € (rapport PDF + Loom + politique CI, livré J+5), audit équipe 1 490 €.\n\n---\n\n## Auteur\n\n**Aïssa BELKOUSSA** — consultant IA & dev, France\n[aissabelkoussa.fr](https://aissabelkoussa.fr) · [GitHub](https://github.com/aissablk1)\n\n## Licence\n\nMIT — fait pour être forké, audité, amélioré.\n","readmeFilename":"README.md"}