registry / recess-cli / 3.24.0
recess-cli@3.24.0
Safe Recess administration and family AI tools from the command line.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install hook automatically replaces first-party guidance in user-level agent skill directories, creating a limited agent extension lifecycle risk. The shipped guidance contains permission-scope and confirmation safeguards, and the indicated apps.js write occurs only through an explicit CLI scaffold command.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the published package through npm, which runs its postinstall hook.
Impact
Agent guidance is changed without a separate setup command, leaving a limited agent extension lifecycle risk; the inspected guidance itself includes scope checks and explicit write approval.
Mechanism
The hook calls installSkill, which replaces the recess-cli skill in the configured or default agent skill directories and removes a superseded recess-admin skill directory.
AI rationale
The install hook automatically replaces first-party guidance in user-level agent skill directories, creating a limited agent extension lifecycle risk. The shipped guidance contains permission-scope and confirmation safeguards, and the indicated apps.js write occurs only through an explicit CLI scaffold command.
Evidence
package.jsonscripts/postinstall.mjsdist/setup.jsskill/recess-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines a postinstall hook that runs scripts/postinstall.mjs.
- The postinstall hook imports the setup module and calls installSkill for published installs when the checkout guard does not apply.
- installSkill targets skill directories under the user’s Codex and Claude homes, replacing the current recess-cli skill and removing the superseded recess-admin directory.
- The shipped skill routes agents through scope checks and requires previews and explicit approval before writes.
- The indicated apps.js location writes AGENTS.md as part of the explicit apps init command.
Evidence against
- The installed skill is first-party guidance for the recess command and describes permission-scoped access and confirmation steps.
- The apps init behavior is an explicit CLI scaffold action, not an install-time write.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/commands/onboarding.jsView file
576patternName = generic_password
severity = medium
line = 576
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/onboarding.jsView on unpkg · L576Findings
2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/commands/onboarding.js
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to recess-cli@3.24.0.
See all versions of recess-cli for other recorded verdicts.
- Review the evidence and your use of recess-cli@3.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.