registry / chat-recall / 0.5.28
chat-recall@0.5.28
One memory across every AI coding tool — indexes Claude Code, Gemini CLI, Codex, OpenCode, Antigravity and Cursor sessions, redacts secrets, and exposes them to your agent over MCP.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo npm install lifecycle hook or self-dependency was found, so the evidence does not meet the blocking install-hook-abuse threshold. The automatic cross-tool skill setup and same-server remote updater are concrete dangerous capabilities that warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run chat-recall-mcp, or sync after logging in to a server that advertises a newer CLI.
Impact
The configured server can cause replacement of the global chat-recall installation; installed skills and hooks can affect AI-agent behavior.
Mechanism
Automatic AI-skill installation and server-controlled package update.
AI rationale
No npm install lifecycle hook or self-dependency was found, so the evidence does not meet the blocking install-hook-abuse threshold. The automatic cross-tool skill setup and same-server remote updater are concrete dangerous capabilities that warrant a warning.
Evidence
package.jsondist/mcp.jsdist/install-skills.jsdist/cli.jshooks/chat_recall_escalate_hook.sh~/.claude/hooks.json~/.chat-recall/credentials.json
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The MCP entrypoint automatically installs or refreshes bundled skills into detected AI tool directories when the MCP server starts.
- The package downloads an update from the configured server, accepts a checksum supplied by that same server, and runs npm to install the downloaded archive.
- The CLI can write command hooks into Claude configuration; those hooks run the package after AI-session events.
- The default configured service host is chatrecall.dev.
Evidence against
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- Skill removal is limited to package-marked directories, and unmarked same-name skills are skipped.
- Network sync and updates use the user-configured login server rather than a hidden fixed credential endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
18 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
1200for (var i = 0; i < flen; ) {
L1201: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1202: lastPos = lastPos > -1 ? lastPos : 0;
...
L1435: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1436: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1437: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L2000:
L2001: // ../../node_modules/thread-stream/package.json
L2002: var require_package = __commonJS({
...
L2045: type: "git",
L2046: url: "git+https://github.com/mcollina/thread-stream.git"
L2047: },
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/watch.jsView on unpkg · L120013185try {
L13186: const out2 = execFileSync2("powershell", [
L13187: "-NoProfile",
Findings
3 Critical11 High7 Medium5 Low
CriticalCredential Exfiltrationdist/watch.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/mcp.js
HighEntrypoint Foreign Package Code Overwritedist/mcp.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/watch.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.28.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.