recess-cli@3.13.0

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The install-time skill refresh is a real, unattended agent integration, but source inspection shows it is limited to first-party package-owned skill directories. This fits a warning for agent extension lifecycle risk, not a confirmed malicious attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing the published package through a package manager that runs postinstall.

Impact

The package-owned skill files are replaced during installation and can influence how those agents use recess-cli; no credential exposure or remote execution was identified.

Mechanism

The hook imports installSkill, which removes and copies the recess-cli skill directory and removes the legacy recess-admin skill directory under each agent's skills root.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsdist/commands/apps.jsdist/update-notice.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs scripts/postinstall.mjs automatically on install.
The postinstall imports and invokes installSkill for published installs without prompting.
installSkill replaces the package-owned recess-cli skill in Codex and Claude skill directories and removes the legacy recess-admin skill directory.
The apps command writes AGENTS.md only to the explicitly selected app folder.

Evidence against

The install hook sets up this package's own agent skill; inspected code shows no broad agent configuration writes, credential forwarding, or remote payload execution.
The update notice records a local timestamp and displays an update command; it does not silently run that command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

package.jsonView file

Lines 44-66json

44 "esbuild": "^0.28.2",

45 "openapi-typescript": "^7.8.0",

46 "oxlint": "^1.28.0",

47 "oxlint-tsgolint": "^0.6.0",

48 "typescript": "^5.9.2",

49 "vitest": "^1.6.0",

50 "@tryrecess/typescript-config": "0.0.0"

51 },

52 "scripts": {

53 "build": "tsgo",

54 "client:generate": "node scripts/generate-api-types.mjs",

55 "typecheck": "tsgo --noEmit",

56 "format": "oxfmt --ignore-path .oxfmtignore --check",

57 "format:fix": "oxfmt --ignore-path .oxfmtignore",

58 "lint": "oxlint --type-aware src/*.ts src/commands/*.ts",

59 "lint:fix": "oxlint --type-aware --fix src/*.ts src/commands/*.ts",

60 "test": "vitest run",

61 "install-local": "pnpm run build && make install-local",

62 "install-persistent": "pnpm run build && make install-persistent",

63 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

64 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 }

66}

dist/commands/onboarding.jsView file

Lines 544-584javascript

544 const body = grade === undefined ? {} : { grade };

545 return writeCommand(parsed, {

546 action: "provision or reconnect the kid's Math Academy account (vendor write; cannot be automatically undone)",

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs

dist/update-notice.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = recess-cli@2.7.0 matchedIdentity = npm:cmVjZXNzLWNsaQ:2.7.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update-notice.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/onboarding.jsView file

564patternName = generic_password severity = medium line = 564

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/onboarding.jsView on unpkg · L564

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltadist/update-notice.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/commands/onboarding.js

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to recess-cli@3.13.0.

See all versions of recess-cli for other recorded verdicts.

Review the evidence and your use of recess-cli@3.13.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 10:15:43.850Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.