chat-recall@0.7.0
Shared team knowledge, leaked-secret alerts, ranked code findings and tracked tasks, across every AI coding tool you use
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malware or unconsented npm lifecycle abuse, but it is a real agent-control capability activated by init. The appropriate outcome is a warning for conditional remote agent-extension installation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs chat-recall init with MCP setup enabled and a saved or newly authenticated server target.
Impact
A compromised or untrusted configured server could place skills, commands, or MCP configuration that affect local AI-agent behavior.
Mechanism
Server-supplied agent artifact installation into local AI-tool directories.
AI rationale
This is not concrete malware or unconsented npm lifecycle abuse, but it is a real agent-control capability activated by init. The appropriate outcome is a warning for conditional remote agent-extension installation.
Evidence
dist/cli.jsdist/auto-update.js~/.mcp.json~/.codex/config.toml~/.config/opencode/opencode.json~/.cursor/mcp.jsonSKILL.md
Network endpoints1
chatrecall.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes CLI entrypoints but has no install lifecycle hook, so the risky behavior is runtime-command driven.
- The init command fetches MCP entries from each saved server using that server's token and passes the returned rows to a pull routine.
- The pull routine writes server-provided skill bodies into AI-tool skill directories without an approval step for each artifact.
- The updater downloads a verified tarball and invokes its install dependency; it is enabled by default after a newer server release is offered.
Evidence against
- No preinstall, install, or postinstall script is declared.
- The MCP and sync requests use saved server URLs and their associated device tokens rather than a hidden fixed recipient.
- The updater derives its tarball from the configured server origin and checks its advertised SHA-256.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
20 flaggeddist/self-restart.jsView file
40*/
L41: import { spawn } from 'child_process';
L42: import { readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/self-restart.jsView on unpkg · L40dist/watch.jsView file
12312try {
L12313: const out2 = execFileSync2("powershell", [
L12314: "-NoProfile",
High
1219for (var i = 0; i < flen; ) {
L1220: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L1221: lastPos = lastPos > -1 ? lastPos : 0;
...
L1454: fsWriteSync = () => fs.writeSync(this.fd, this._writingBuf);
L1455: fsWrite = () => fs.write(this.fd, this._writingBuf, this.release);
L1456: } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
...
L2019:
L2020: // ../../node_modules/thread-stream/package.json
L2021: var require_package = __commonJS({
...
L2064: type: "git",
L2065: url: "git+https://github.com/mcollina/thread-stream.git"
L2066: },
Findings
3 Critical13 High7 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/auto-update.js
HighChild Processdist/self-restart.js
HighShelldist/watch.js
HighSame File Env Network Executiondist/mcp.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/watch.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/mcp.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js
High
Affected versions and remediation
This report applies to chat-recall@0.7.0.
See all versions of chat-recall for other recorded verdicts.
- Review the evidence and your use of chat-recall@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.