registry / AI-agent control-surface risk / recess-cli
recess-cli
Safe Recess administration and family AI tools from the command line.
This report shows the evidence for recess-cli@2.6.0. 1 of 45 known versions is blocked or flagged. The newest version, 3.25.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete automatic lifecycle path that overwrites both Codex and Claude skill directories. Under the install-control-surface policy, this is malicious install-hook abuse even though the code has path checks and no secret exfiltration was found.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation, through the postinstall lifecycle hook.
Impact
A package installation can change local AI-agent behavior and remove an existing skill directory.
Mechanism
Automatic recursive replacement of AI-agent skill directories.
Policy narrative
npm runs scripts/postinstall.mjs automatically. It imports dist/setup.js, which resolves Codex and Claude configuration homes, recursively removes each recess-cli skill directory, and copies a package-controlled skill into it. The explicit setup path additionally fetches a skill bundle from the configured Recess API and writes it to the same directories. This is unconsented postinstall mutation of broad AI-agent control surfaces.
AI rationale
The package has a concrete automatic lifecycle path that overwrites both Codex and Claude skill directories. Under the install-control-surface policy, this is malicious install-hook abuse even though the code has path checks and no secret exfiltration was found.
Evidence
package.jsonscripts/postinstall.mjsdist/setup.jsdist/skill-update.js$CODEX_HOME/skills/recess-cli$CLAUDE_CONFIG_DIR/skills/recess-cli$CODEX_HOME/skills/recess-admin$CLAUDE_CONFIG_DIR/skills/recess-admin
Network endpoints1
api.recess.gg/auth/admin-cli/skill/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook automatically imports and runs the skill installer.
- The installer targets both Codex and Claude user skill directories.
- Installation recursively deletes the existing skill and copies the package-supplied replacement without an explicit user command.
- A runtime setup command can also download server-provided Markdown and write it into those same agent skill directories.
Evidence against
- The postinstall script skips source checkouts and suppresses failures.
- The remote bundle updater restricts received filenames to Markdown and checks destination containment.
- No credential harvesting or unrelated network exfiltration was found in the inspected lifecycle path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/commands/onboarding.jsView file
545patternName = generic_password
severity = medium
line = 545
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/onboarding.jsView on unpkg · L545Findings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/commands/onboarding.js
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to recess-cli@2.6.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing recess-cli@2.6.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
45 known versions3.25.0latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 2:29 AM3.24.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 3:47 PM3.23.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 12:28 AM3.22.1SuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 8:08 PM