Loading npm security reports…

recess-cli@2.6.0: AI-agent control-surface risk | LPM Firewall

registry / recess-cli / 2.6.0

recess-cli@2.6.0

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically replaces agent skill directories for Codex and Claude. This can alter the instructions those agents load without a separate setup command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

A package installation can change local AI-agent behavior and remove an existing skill directory.

Mechanism

Automatic recursive replacement of AI-agent skill directories.

Policy narrative

npm runs scripts/postinstall.mjs automatically. It imports dist/setup.js, which resolves Codex and Claude configuration homes, recursively removes each recess-cli skill directory, and copies a package-controlled skill into it. The explicit setup path additionally fetches a skill bundle from the configured Recess API and writes it to the same directories. This is unconsented postinstall mutation of broad AI-agent control surfaces.

Rationale

The package has a concrete automatic lifecycle path that overwrites both Codex and Claude skill directories. Under the install-control-surface policy, this is malicious install-hook abuse even though the code has path checks and no secret exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsdist/skill-update.js$CODEX_HOME/skills/recess-cli$CLAUDE_CONFIG_DIR/skills/recess-cli$CODEX_HOME/skills/recess-admin$CLAUDE_CONFIG_DIR/skills/recess-admin

Source & flagged code

4 flagged

package.jsonView file

Lines 37-59json

37 "esbuild": "^0.28.2",

38 "openapi-typescript": "^7.8.0",

39 "oxlint": "^1.28.0",

40 "oxlint-tsgolint": "^0.6.0",

41 "typescript": "^5.9.2",

42 "vitest": "^1.6.0",

43 "@tryrecess/typescript-config": "0.0.0"

44 },

45 "scripts": {

46 "build": "tsc",

47 "client:generate": "node scripts/generate-api-types.mjs",

48 "typecheck": "tsgo --noEmit",

49 "format": "oxfmt --ignore-path .oxfmtignore --check",

50 "format:fix": "oxfmt --ignore-path .oxfmtignore",

51 "lint": "oxlint --type-aware src/*.ts src/commands/*.ts",

52 "lint:fix": "oxlint --type-aware --fix src/*.ts src/commands/*.ts",

53 "test": "vitest run",

54 "install-local": "pnpm run build && make install-local",

55 "install-persistent": "pnpm run build && make install-persistent",

56 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

57 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 }

59}

dist/commands/onboarding.jsView file

Lines 525-565javascript

525 const body = grade === undefined ? {} : { grade };

526 return writeCommand(parsed, {

527 action: "provision or reconnect the kid's Math Academy account (vendor write; cannot be automatically undone)",

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs