recess-cli@3.23.0

Safe Recess administration and family AI tools from the command line.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall hook automatically replaces package-owned skills in global Codex and Claude skill folders and removes the legacy skill directory. This creates agent extension lifecycle risk, but the inspected source does not establish a broader control-surface attack, so the appropriate action is a warning.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the published package runs its postinstall hook.

Impact

Agent guidance can be changed without running the explicit setup command; the inspected source supports a first-party agent extension lifecycle warning.

Mechanism

The hook imports the bundled setup module and invokes an installer that removes and recopies skill directories under the agent configuration homes.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsskill/recess-cli/SKILL.md~/.codex/skills/recess-cli~/.claude/skills/recess-cli~/.codex/skills/recess-admin~/.claude/skills/recess-admin

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest registers a postinstall hook that runs the package script.
For published installs, the hook imports the setup module and calls the skill installer; source checkouts and installs missing that module exit early.
The installer targets Codex and Claude skill folders under their configuration homes, with environment-variable overrides.
The installer recursively replaces each recess-cli skill folder and removes the legacy recess-admin folder.
The bundled skill describes itself as a router for using the Recess command and related agent guidance.
The AGENTS.md integration target is written by apps init into a selected folder; that command refuses a nonempty folder unless forced.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

4 flagged

package.jsonView file

Lines 44-66json

44 "esbuild": "^0.28.2",

45 "openapi-typescript": "^7.8.0",

46 "oxlint": "^1.28.0",

47 "oxlint-tsgolint": "^0.6.0",

48 "typescript": "^5.9.2",

49 "vitest": "^1.6.0",

50 "@tryrecess/typescript-config": "0.0.0"

51 },

52 "scripts": {

53 "build": "node node_modules/@tryrecess/typescript-config/bin/tsc-fast.mjs",

54 "client:generate": "node scripts/generate-api-types.mjs",

55 "typecheck": "node node_modules/@tryrecess/typescript-config/bin/tsc-fast.mjs --noEmit",

56 "format": "oxfmt --ignore-path .oxfmtignore --check",

57 "format:fix": "oxfmt --ignore-path .oxfmtignore",

58 "lint": "oxlint --type-aware src/*.ts src/commands/*.ts",

59 "lint:fix": "oxlint --type-aware --fix src/*.ts src/commands/*.ts",

60 "test": "vitest run",

61 "install-local": "pnpm run build && make install-local",

62 "install-persistent": "pnpm run build && make install-persistent",

63 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

64 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 }

66}

dist/commands/onboarding.jsView file

Lines 556-596javascript

556 };

557 return writeCommand(parsed, {

558 action: "provision or reconnect the kid's Math Academy account (vendor write; cannot be automatically undone)",

559 target: { familyId, kidUserId },

560 request: body,

561 }, async () => unwrap(await

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/onboarding.jsView file

576patternName = generic_password severity = medium line = 576

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/onboarding.jsView on unpkg · L576

Findings

1 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/commands/onboarding.js

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to recess-cli@3.23.0.

See all versions of recess-cli for other recorded verdicts.

Review the evidence and your use of recess-cli@3.23.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 00:34:26.687Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.