chat-recall@0.5.6
Local-first memory for AI coding tools — indexes Claude Code / Gemini CLI / OpenCode / Codex sessions, exposes them over MCP, optionally syncs redacted history to a chat-recall server
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-invoked AI-agent integration package with real context and configuration effects, warranting a warning under the explicit-command policy. Its behavior is package-aligned and no concrete malicious chain was confirmed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `chat-recall init`, `install-skills`, `install-hooks`, or `team pull`.
Impact
Installed hooks and MCP configuration can influence agent context; team artifacts may add files to supported AI-tool directories.
Mechanism
Explicit AI-agent configuration, hook registration, and optional session synchronization.
AI rationale
This is a user-invoked AI-agent integration package with real context and configuration effects, warranting a warning under the explicit-command policy. Its behavior is package-aligned and no concrete malicious chain was confirmed.
Evidence
package.jsondist/cli.jsdist/install-skills.jshooks/chat_recall_wakeup_hook.shhooks/chat_recall_resume_hook.sh~/.claude/hooks.json~/.claude/chat-recall-hooks/~/.claude/skills/~/.gemini/skills/~/.codex/skills/
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `init` configures MCP, installs skills, and can sync local sessions.
- Explicit `install-hooks` writes command hooks into Claude configuration.
- Bundled resume/wake-up hooks inject recall-derived context into Claude sessions.
- `team pull` can write server-supplied team artifacts into AI-tool directories after an explicit command.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- AI-agent configuration and hooks require explicit CLI commands; no import-time setup found.
- Skill installer skips non-managed user-owned skill directories.
- No credential harvesting or exfiltration beyond user-configured server sync was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
17 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { statSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
11897try {
L11898: const out2 = execFileSync2("powershell", [
L11899: "-NoProfile",
High
1169Cross-file remote execution chain: dist/watch.js spawns dist/mcp.js; helper contains network access plus dynamic code execution.
L1169: for (var i = 0; i < flen; ) {
L1170: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1171: lastPos = lastPos > -1 ? lastPos : 0;
...
L1404: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1405: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1406: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L1969:
L1970: // ../../node_modules/thread-stream/package.json
L1971: var require_package = __commonJS({
...
L2014: type: "git",
L2015: url: "git+https://github.com/mcollina/thread-stream.git"
L2016: },
Findings
3 Critical10 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/service-installer.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/mcp.js
HighCommand Output Exfiltrationdist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
HighCross File Remote Execution Contextdist/watch.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
Affected versions and remediation
This report applies to chat-recall@0.5.6.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.5.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.