registry / @cotal-ai/cli / 0.129.4
@cotal-ai/cli@0.129.4
Cotal mesh CLI: up, join, watch, console, spawn, mint, channels, history, ext.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged process execution and agent-skill writes support ordinary CLI setup behavior, and the global installation asks for confirmation. Runtime telemetry is disclosed, goes to Cotal’s endpoint, and has an opt-out; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Telemetry runs with CLI commands when enabled; skill writes and the optional global install occur through setup.
Impact
No malicious impact identified in the inspected source.
Mechanism
Telemetry posts usage events to the package’s own endpoint. Setup can reconcile Cotal skills and, after confirmation, install the CLI globally.
AI rationale
The flagged process execution and agent-skill writes support ordinary CLI setup behavior, and the global installation asks for confirmation. Runtime telemetry is disclosed, goes to Cotal’s endpoint, and has an opt-out; no concrete attack behavior was found.
Evidence
~/.agents/skills/<name>/SKILL.md
Network endpoints1
cotal.ai/v1/telemetry
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI discloses its telemetry endpoint and fields, says identifying values are masked, and provides `minimal` and `off` settings.
- Telemetry sending returns early when the effective level is `off`.
- The optional global npm install is offered by the setup flow and asks for confirmation in an interactive terminal.
- Agent skill reconciliation copies the package’s canonical skills to the documented `~/.agents/skills` location.
Evidence against
- The inspected behaviors fit the CLI’s setup and telemetry features; no concrete attack behavior was identified.
- Telemetry is sent to the package’s own `cotal.ai` endpoint, and the source provides an opt-out.
- The global install prompt explains the action and allows the user to decline.
- Skill reconciliation handles Cotal’s own skill files and backs up divergent user edits.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
18 flaggeddist/seed/reconcile.jsView file
1import { existsSync, renameSync } from "node:fs";
L2: import { spawnSync } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/seed/reconcile.jsView on unpkg · L1dist/lib/persona-files.jsView file
274process.on(signal, pass);
L275: const child = program ? spawn(program, [draft], { stdio: "inherit" }) : spawn(`${editor} ${quoted}`, { shell: true, stdio: "inherit" });
L276: return new Promise(resolve => {
High
dist/lib/nats-bin.jsView file
Findings
17 High4 Medium4 Low
HighChild Processdist/seed/reconcile.js
HighShelldist/lib/persona-files.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/agent-skills.js
HighRuntime Package Installdist/commands/setup.js
HighSemantic Analysis Limiteddist/commands/ext.js
HighKnown Malware Source Similaritydist/telemetry.js
HighKnown Malware Source Similaritydist/commands/spawn.js
HighKnown Malware Source Similaritydist/commands/up.js
HighKnown Malware Source Similaritydist/lib/self-exec.js
HighKnown Malware Source Similaritydist/lib/service-process.js
HighKnown Malware Source Similaritydist/commands/ext.js
Affected versions and remediation
This report applies to @cotal-ai/cli@0.129.4.
See all versions of @cotal-ai/cli for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/cli@0.129.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.