registry / chat-recall / 0.5.31
chat-recall@0.5.31
One memory across every AI coding tool — indexes Claude Code, Gemini CLI, Codex, OpenCode, Antigravity and Cursor sessions, redacts secrets, and exposes them to your agent over MCP.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install lifecycle hook or fixed credential-exfiltration endpoint was found. The automatic cross-agent instruction deployment and default-on server-controlled updater are concrete lifecycle risks that warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Start chat-recall-mcp, or sync with a configured server that advertises a newer CLI release.
Impact
The package can alter agent behavior across supported tools and install code supplied by a configured sync server.
Mechanism
Automatic multi-agent skill deployment and server-directed self-update.
AI rationale
No install lifecycle hook or fixed credential-exfiltration endpoint was found. The automatic cross-agent instruction deployment and default-on server-controlled updater are concrete lifecycle risks that warrant a warning.
Evidence
dist/mcp.jsdist/install-skills.jsdist/auto-update.jsskills/chat-recall/SKILL.mdskills/chat-recall-find/SKILL.mdskills/chat-recall-memory/SKILL.mdskills/chat-recall-project/SKILL.mdskills/chat-recall-resume/SKILL.mdskills/chat-recall-changes/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Starting the MCP server automatically refreshes bundled skills into detected third-party AI tools.
- The skill installer copies package-provided instructions into Claude, Gemini, Codex, OpenCode, and Cursor skill locations.
- Sync responses can trigger a default-enabled self-update that downloads, installs, and restarts the package.
Evidence against
- package.json has no install lifecycle hook.
- The skill installer skips user-owned destinations and marks only its own managed directories.
- The updater derives its tarball URL from the configured server and verifies a supplied SHA-256 digest.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
19 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
13172try {
L13173: const out2 = execFileSync2("powershell", [
L13174: "-NoProfile",
High
dist/telemetry.jsView file
128// eslint-disable-next-line @typescript-eslint/no-var-requires
L129: const { createHash } = require('node:crypto');
L130: return createHash('sha256').update(value).digest('hex').slice(0, 12);
Findings
3 Critical12 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/mcp.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.5.31.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.