registry / chat-recall / 0.6.4
chat-recall@0.6.4
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry install hook or self-dependency chain, but its MCP runtime automatically writes behavior-bearing skills across multiple AI-agent control surfaces. This warrants a warning for agent-extension lifecycle risk rather than a malware block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the configured MCP server, or explicitly running init, install-skills, sync, or watch service commands.
Impact
It can alter local AI-agent behavior-bearing skill directories and transmit indexed session data to a user-configured server.
Mechanism
Automatic multi-tool skill installation and configured session synchronization.
AI rationale
The package has no registry install hook or self-dependency chain, but its MCP runtime automatically writes behavior-bearing skills across multiple AI-agent control surfaces. This warrants a warning for agent-extension lifecycle risk rather than a malware block.
Evidence
dist/mcp.jsdist/install-skills.jsdist/sync-client.jsskills/*/SKILL.md~/.chat-recall/credentials.jsonAI-tool skill directories
Network endpoints2
chatrecall.dev${base}/api/sync
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The MCP entry point automatically refreshes bundled skills into multiple installed AI tools when it runs.
- The skill installer recursively deletes and replaces its managed skill directories across AI-tool configuration locations.
- The CLI can collect local AI-session data and post it, with an authorization token, to the server saved during login.
- The package includes a user-level background-service installer, but it is reached through explicit CLI options rather than npm lifecycle hooks.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The external sync destination is selected during login and stored as a configured target, rather than being a hidden fixed endpoint.
- No source evidence shows a self-dependency chain, secret theft, or install-time execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
20 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
12522try {
L12523: const out2 = execFileSync2("powershell", [
L12524: "-NoProfile",
High
1200for (var i = 0; i < flen; ) {
L1201: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1202: lastPos = lastPos > -1 ? lastPos : 0;
...
L1435: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1436: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1437: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L2000:
L2001: // ../../node_modules/thread-stream/package.json
L2002: var require_package = __commonJS({
...
L2045: type: "git",
L2046: url: "git+https://github.com/mcollina/thread-stream.git"
L2047: },
Findings
3 Critical13 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/service-installer.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.6.4.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.