recess-cli@3.19.1

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The install hook makes a user-level agent skill change automatically, which fits the warning-only policy for package-owned agent setup. The inspected sources do not establish a concrete malicious attack.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the npm package runs its postinstall hook.

Impact

A user's agent skill contents are changed during installation, before a separate setup command is run.

Mechanism

The hook invokes bundled setup code that removes the existing `recess-cli` skill destination and copies the package's bundled skill there.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsskill/recess-cli/SKILL.md~/.codex/skills/recess-cli~/.claude/skills/recess-cli

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest defines postinstall as `node scripts/postinstall.mjs`, which imports the bundled setup module and calls `installSkill()` automatically.
Setup targets the user-level Codex and Claude `recess-cli` skill folders, removes each existing destination, and copies in the bundled skill.
The bundled skill is a Recess CLI instruction router, making this package-owned agent setup; its installation is still an automatic user-level change.
The separate AGENTS.md write occurs under the explicit `apps init` command and creates local app authoring instructions.

Evidence against

The inspected postinstall installs this package's own named skill; it does not establish a broad foreign agent configuration change or credential transfer.
The AGENTS.md behavior is triggered by `apps init`, not by package installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

4 flagged

package.jsonView file

Lines 44-66json

44 "esbuild": "^0.28.2",

45 "openapi-typescript": "^7.8.0",

46 "oxlint": "^1.28.0",

47 "oxlint-tsgolint": "^0.6.0",

48 "typescript": "^5.9.2",

49 "vitest": "^1.6.0",

50 "@tryrecess/typescript-config": "0.0.0"

51 },

52 "scripts": {

53 "build": "node node_modules/@tryrecess/typescript-config/bin/tsc-fast.mjs",

54 "client:generate": "node scripts/generate-api-types.mjs",

55 "typecheck": "node node_modules/@tryrecess/typescript-config/bin/tsc-fast.mjs --noEmit",

56 "format": "oxfmt --ignore-path .oxfmtignore --check",

57 "format:fix": "oxfmt --ignore-path .oxfmtignore",

58 "lint": "oxlint --type-aware src/*.ts src/commands/*.ts",

59 "lint:fix": "oxlint --type-aware --fix src/*.ts src/commands/*.ts",

60 "test": "vitest run",

61 "install-local": "pnpm run build && make install-local",

62 "install-persistent": "pnpm run build && make install-persistent",

63 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

64 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 }

66}

dist/commands/onboarding.jsView file

Lines 544-584javascript

544 const body = grade === undefined ? {} : { grade };

545 return writeCommand(parsed, {

546 action: "provision or reconnect the kid's Math Academy account (vendor write; cannot be automatically undone)",

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/onboarding.jsView file

564patternName = generic_password severity = medium line = 564

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/onboarding.jsView on unpkg · L564

Findings

1 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/commands/onboarding.js

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to recess-cli@3.19.1.

See all versions of recess-cli for other recorded verdicts.

Review the evidence and your use of recess-cli@3.19.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 09:06:01.880Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.