registry / trackly-cli / 0.20.1
trackly-cli@0.20.1
AI job search CLI + hosted MCP server with OAuth. 250K+ jobs, 5,400+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged process execution supports opening a URL or explicit agent setup, while API credentials are sent to the configured Trackly origin over HTTPS. MCP analytics are disclosed with opt-outs, and no install-time behavior or hidden data collection was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Users invoke CLI commands; agent setup requires `trackly agent setup`, and MCP analytics run when the MCP server is used.
Impact
No malicious impact identified.
Mechanism
API requests go to the configured Trackly base URL. Analytics are disclosed and opt-out capable. Agent setup installs the bundled skill and registers Trackly with the selected client.
AI rationale
The flagged process execution supports opening a URL or explicit agent setup, while API credentials are sent to the configured Trackly origin over HTTPS. MCP analytics are disclosed with opt-outs, and no install-time behavior or hidden data collection was identified.
Network endpoints1
closeai.mba
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and lists development or audit scripts, with no install lifecycle hook.
- Importing the CLI does not start it; main runs only when bin/trackly is invoked directly.
- Trackly requests are restricted to the configured base URL, and credential requests require HTTPS or localhost.
- Agent skill and MCP setup runs only through the explicit `trackly agent setup` command.
- The README discloses default MCP analytics, describes excluded data, and provides account and environment opt-outs.
Evidence against
- Default-on runtime MCP analytics merit review, but are disclosed and have opt-outs.
- Agent setup writes the package’s skill and registers its MCP server, but requires an explicit command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedscripts/verify-audit-exceptions.jsView file
6const path = require('node:path');
L7: const { spawnSync } = require('node:child_process');
L8:
High
Child Process
Package source references child process execution.
scripts/verify-audit-exceptions.jsView on unpkg · L6bin/trackly#virtual:normalized:round1View file
18const { color, isJSON, jobDateDetailLines, outputJobs, outputCompanies, outputStats, outputContacts, outputReferralCampaign, outputNetworkBrief, outputCompanyBrief, outputCompanyWo...
L19: const http = require("http");
L20: const crypto = require("crypto");
L21: const { spawnSync } = require("child_process");
L22: const { version: VERSION } = require("../package.json");
L23: const { doctorAgent, resumeValidationStatus, setupAgent } = require("../lib/agent");
...
L223:
L224: function failNow(message, exitCode = 1) {
L225: outputError(message);
...
L311: // Flags deprecated in the API-docs-plan fixup. Still accepted by parseArgs so old
L312: // scripts don"t ERR_NOT_FOUND, but cmdJobs hard-rejects them with a migration hint\n// — silent no-op would be worse than noise (per PR #13 Codex
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
1 Critical3 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/trackly
HighChild Processscripts/verify-audit-exceptions.js
HighCommand Output Exfiltrationbin/trackly#virtual:normalized:round1
HighSemantic Analysis Limitedbin/trackly#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/trackly
Affected versions and remediation
This report applies to trackly-cli@0.20.1.
See all versions of trackly-cli for other recorded verdicts.
- Review the evidence and your use of trackly-cli@0.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.