@cotal-ai/cli@0.121.3
Cotal mesh CLI: up, join, watch, console, spawn, mint, channels, history, ext.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time attack, but it enables regular telemetry by default and sends terminal and installation inventory details alongside command events. An opt-out and partial disclosure reduce the risk, so this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a recognized CLI command while telemetry is not disabled; the first use defaults to regular.
Impact
The package operator receives account and usage identifiers plus terminal and installation inventory details without an explicit opt-in.
Mechanism
The CLI records command events and a daily install summary, then posts them to its telemetry endpoint as the process exits.
AI rationale
The package has no install-time attack, but it enables regular telemetry by default and sends terminal and installation inventory details alongside command events. An opt-out and partial disclosure reduce the risk, so this warrants a warning rather than a publish block.
Evidence
dist/command.jsdist/telemetry.jsdist/commands/telemetry.js~/.cotal/telemetry.json~/.cotal/idp-sessions.json
Network endpoints1
cotal.ai/v1/telemetry
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- First use creates telemetry settings at the regular level with a random install ID.
- The CLI arms telemetry for recognized commands and posts events when each process exits.
- Regular command events add account hash, subcommand and flag names, masked error details, shell name and terminal program.
- A daily install event includes OS release, installed connector, extension and runtime names, mesh count, and hosted mesh status.
- A TTY notice and the telemetry command disclose telemetry and offer an off setting, but the notice does not list all collected fields.
Evidence against
- The manifest declares no lifecycle scripts, so this collection is not triggered by package installation.
- Telemetry is sent to the package’s own endpoint, and the code masks error text and stack paths.
- The CLI provides off and minimal telemetry levels; no credential value or command argument value is sent by the reviewed telemetry code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
7 flaggeddist/seed/reconcile.jsView file
1import { existsSync, renameSync } from "node:fs";
L2: import { spawnSync } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/seed/reconcile.jsView on unpkg · L1dist/lib/persona-files.jsView file
274process.on(signal, pass);
L275: const child = program ? spawn(program, [draft], { stdio: "inherit" }) : spawn(`${editor} ${quoted}`, { shell: true, stdio: "inherit" });
L276: return new Promise(resolve => {
High
dist/lib/nats-bin.jsView file
Findings
1 Critical5 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/telemetry.js
HighChild Processdist/seed/reconcile.js
HighShelldist/lib/persona-files.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/agent-skills.js
HighRuntime Package Installdist/commands/setup.js
HighSemantic Analysis Limiteddist/commands/ext.js
MediumDynamic Requiredist/lib/nats-bin.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cotal-ai/cli@0.121.3.
See all versions of @cotal-ai/cli for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/cli@0.121.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.