trackly-cli@0.22.3
Search Thousands of jobs across Thousands of companies with the Trackly CLI and MCP server for Claude, ChatGPT, Codex and Cursor. Filter by role, location, salary and sponsorship; track jobs and prepare applications.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package enables disclosed MCP usage telemetry by default and provides no user opt-out, including removing a previously stored opt-out setting. Its limited, sanitized reporting to Trackly’s own service supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
MCP server startup and subsequent tool events.
Impact
Trackly can receive MCP usage activity associated with an authenticated account. The README discloses the collection and its exclusions, but users cannot opt out.
Mechanism
The analytics instrumentation sends sanitized events to Trackly’s authenticated or anonymous analytics relay; authenticated events use the Trackly authorization context.
AI rationale
The package enables disclosed MCP usage telemetry by default and provides no user opt-out, including removing a previously stored opt-out setting. Its limited, sanitized reporting to Trackly’s own service supports a warning rather than a block.
Evidence
mcp/server.jsmcp/analytics.jslib/client.jsREADME.md
Network endpoints3
closeai.mba/api/jobscout/mcp-analyticscloseai.mba/api/jobscout/mcp-analytics/anonymouscloseai.mba/api/jobscout/analytics-preference
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Starting the MCP server configures analytics automatically; analytics are enabled by default and the code says there is no user opt-out.
- The package retires the prior analytics opt-out setting, and the README says MCP usage analytics have no account-level opt-out.
- Authenticated analytics events are relayed with the Trackly authorization context to the analytics endpoint.
Evidence against
- The README discloses the analytics and says raw queries, conversation text, résumé text, profile answers, and application notes are excluded.
- The analytics relay targets Trackly’s own service; source projects tool arguments and responses into restricted fields, including retaining search text only as its length.
- The flagged child-process use opens a URL for an explicit login action; the audit script runs npm audit only when invoked.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedscripts/verify-audit-exceptions.jsView file
6const path = require('node:path');
L7: const { spawnSync } = require('node:child_process');
L8:
High
Child Process
Package source references child process execution.
scripts/verify-audit-exceptions.jsView on unpkg · L6bin/trackly#virtual:normalized:round1View file
18const { color, isJSON, jobDateDetailLines, outputJobs, outputCompanies, outputStats, outputContacts, outputReferralCampaign, outputNetworkBrief, outputCompanyBrief, outputCompanyWo...
L19: const http = require("http");
L20: const crypto = require("crypto");
L21: const { spawnSync } = require("child_process");
L22: const { version: VERSION } = require("../package.json");
L23: const { doctorAgent, resumeValidationStatus, setupAgent } = require("../lib/agent");
...
L223:
L224: function failNow(message, exitCode = 1) {
L225: outputError(message);
...
L311: // Flags deprecated in the API-docs-plan fixup. Still accepted by parseArgs so old
L312: // scripts don"t ERR_NOT_FOUND, but cmdJobs hard-rejects them with a migration hint\n// — silent no-op would be worse than noise (per PR #13 Codex
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
1 Critical3 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/trackly
HighChild Processscripts/verify-audit-exceptions.js
HighCommand Output Exfiltrationbin/trackly#virtual:normalized:round1
HighSemantic Analysis Limitedbin/trackly#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencemcp/server.js
MediumAi Review Evidencemcp/analytics.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to trackly-cli@0.22.3.
See all versions of trackly-cli for other recorded verdicts.
- Review the evidence and your use of trackly-cli@0.22.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.