registry / recess-cli / 3.16.1
recess-cli@3.16.1
Safe Recess administration and family AI tools from the command line.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall hook automatically changes agent skill directories, so this warrants a warning under the first-party agent extension lifecycle policy. The inspected behavior does not establish a concrete attack or justify blocking publication.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install of the published package.
Impact
The package's agent instructions are refreshed automatically and an older recess-admin skill directory may be removed.
Mechanism
Postinstall imports setup.js and copies the bundled skill into configured or default agent skill roots, removing an older package-named skill directory.
AI rationale
The postinstall hook automatically changes agent skill directories, so this warrants a warning under the first-party agent extension lifecycle policy. The inspected behavior does not establish a concrete attack or justify blocking publication.
Evidence
package.jsonscripts/postinstall.mjsdist/setup.js~/.codex/skills/recess-cli~/.claude/skills/recess-cli~/.codex/skills/recess-admin~/.claude/skills/recess-admin
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook runs scripts/postinstall.mjs.
- Postinstall imports dist/setup.js and calls installSkill for published installs.
- installSkill replaces package-owned skills and removes a superseded skill directory under Codex and Claude skill roots.
- The apps command writes AGENTS.md only when the user runs the app initialization command.
- The update notice offers an npm self-update when explicitly run.
Evidence against
- The postinstall setup is limited to installing this package's own agent skill; inspected code showed no unrelated configuration mutation or credential forwarding.
- The apps scaffold writes are part of an explicit command and are unrelated to npm install.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/commands/onboarding.jsView file
564patternName = generic_password
severity = medium
line = 564
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/onboarding.jsView on unpkg · L564Findings
2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/update-notice.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/commands/onboarding.js
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to recess-cli@3.16.1.
See all versions of recess-cli for other recorded verdicts.
- Review the evidence and your use of recess-cli@3.16.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.