registry / @cotal-ai/cli / 0.131.3
@cotal-ai/cli@0.131.3
Cotal mesh CLI: up, join, watch, console, spawn, mint, channels, history, ext.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed process execution, skill reconciliation, and package-manager install are tied to CLI workflows, and the manifest contains no install hook. Runtime telemetry is disclosed, can be disabled, and the inspected event construction avoids raw arguments and scrubs error values and paths.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Setup writes and the optional global install are reached through `cotal setup`; feedback and telemetry sends occur through CLI command execution.
Impact
No malicious impact identified. User-invoked setup may write skill files, and disclosed telemetry may send command metadata to Cotal.
Mechanism
Setup reconciles its authored skills into `~/.agents/skills`; telemetry sends disclosed, scrubbed command metadata; re-execution verifies the CLI entry first.
AI rationale
The reviewed process execution, skill reconciliation, and package-manager install are tied to CLI workflows, and the manifest contains no install hook. Runtime telemetry is disclosed, can be disabled, and the inspected event construction avoids raw arguments and scrubs error values and paths.
Evidence
~/.agents/skills/<name>/SKILL.md~/.cotal/agent-skills.json~/.cotal/telemetry.json.cotal/setup.log
Network endpoints3
cotal.ai/v1/telemetrybroker.cotal.ai/v1/feedbackcotal.ai/v1/feedback
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; its scripts are build, typecheck, and smoke-test commands.
- Agent skills are reconciled only when the user invokes `cotal setup` or `cotal setup --skills`; the write logic manages the package’s canonical skill files with ownership checks.
- The optional global npm install is part of `setup` when launched through npx; interactive runs prompt, and noninteractive acceptance follows `--yes` or the documented default.
- Runtime telemetry is described as anonymous, has an `off` setting, and sends command metadata with error values and paths scrubbed.
- Process re-execution checks that the current entry is the CLI’s own entry before spawning a child.
Evidence against
- The package has process execution, external skill-file writes, and a runtime package-manager install capability, but the inspected paths are tied to normal CLI commands.
- Telemetry can include a hashed account identifier and install summary at the regular level, but the package describes the collection and provides an opt-out.
Behavioral surface
Source & flagged code
18 flaggeddist/seed/reconcile.jsView file
1import { existsSync, renameSync } from "node:fs";
L2: import { spawnSync } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/seed/reconcile.jsView on unpkg · L1dist/lib/persona-files.jsView file
274process.on(signal, pass);
L275: const child = program ? spawn(program, [draft], { stdio: "inherit" }) : spawn(`${editor} ${quoted}`, { shell: true, stdio: "inherit" });
L276: return new Promise(resolve => {
High
dist/lib/nats-bin.jsView file
Findings
17 High4 Medium4 Low
HighChild Processdist/seed/reconcile.js
HighShelldist/lib/persona-files.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/agent-skills.js
HighRuntime Package Installdist/commands/setup.js
HighSemantic Analysis Limiteddist/commands/ext.js
HighKnown Malware Source Similaritydist/telemetry.js
HighKnown Malware Source Similaritydist/commands/up.js
HighKnown Malware Source Similaritydist/lib/self-exec.js
HighKnown Malware Source Similaritydist/lib/service-process.js
HighKnown Malware Source Similaritydist/commands/ext.js
HighKnown Malware Source Similaritydist/commands/setup-start.js
Affected versions and remediation
This report applies to @cotal-ai/cli@0.131.3.
See all versions of @cotal-ai/cli for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/cli@0.131.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.