registry / chat-recall / 0.5.18
chat-recall@0.5.18
One memory across every AI coding tool — indexes Claude Code, Gemini CLI, Codex, OpenCode, Antigravity and Cursor sessions, redacts secrets, and exposes them to your agent over MCP.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiMCP startup writes this package's own skills into several foreign agent skill directories, which is first-party agent-extension setup rather than an npm install hook. The same-origin global auto-update is opt-out and checksum-pinned, so the combined behavior is a dangerous product capability and not a hidden install-time takeover.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Process start of the chat-recall-mcp bin, and the watch daemon auto-update timer once stored server credentials exist.
Impact
Detected agent skill directories gain or replace chat-recall-managed skills without a separate install-skills command. A logged-in daemon can replace the installed package with the tarball that server advertises.
Mechanism
skillsNeedRefresh leads to installSkills, which copies bundled skills into Claude, Gemini, Codex, OpenCode, and Cursor skill dirs. runAutoUpdate downloads /install/chat-recall.tgz from the credential origin and runs npm install -g when the server version is newer and the sha256 matches.
AI rationale
MCP startup writes this package's own skills into several foreign agent skill directories, which is first-party agent-extension setup rather than an npm install hook. The same-origin global auto-update is opt-out and checksum-pinned, so the combined behavior is a dangerous product capability and not a hidden install-time takeover.
Evidence
dist/mcp.jsdist/install-skills.jsdist/auto-update.jsdist/watch.js~/.cursor/skills.chat-recall-managed
Network endpoints3
chatrecall.devchatrecall.dev/install/chat-recall.tgzchatrecall.dev/api/capabilities
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes chat-recall, chat-recall-mcp, and chat-recall-watch bins and has no preinstall, install, or postinstall hook.
- dist/mcp.js main() calls installSkills() whenever skillsNeedRefresh() is true as the MCP server starts.
- install-skills.js copies bundled skills into detected Claude, Gemini, Codex, OpenCode, and Cursor skill directories and only skips dirs that lack the package marker.
- The watch daemon calls runAutoUpdate on a timer; auto-update defaults on and runs npm install -g of a tarball from the logged-in server origin.
Evidence against
- Skill copies are this package's own SKILL files and skip a same-named directory that is not marked .chat-recall-managed.
- The update URL is the credential server plus /install/chat-recall.tgz, checksum-pinned, and disabled by CHAT_RECALL_AUTO_UPDATE=0.
- Dependencies do not include chat-recall itself, and Claude hooks are installed only by the install-hooks command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
1200for (var i = 0; i < flen; ) {
L1201: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1202: lastPos = lastPos > -1 ? lastPos : 0;
...
L1435: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1436: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1437: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L2000:
L2001: // ../../node_modules/thread-stream/package.json
L2002: var require_package = __commonJS({
...
L2045: type: "git",
L2046: url: "git+https://github.com/mcollina/thread-stream.git"
L2047: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/watch.jsView on unpkg · L120013185try {
L13186: const out2 = execFileSync2("powershell", [
L13187: "-NoProfile",
Findings
3 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/watch.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.18.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.