RecallBase

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 0.1.0

Overview

The skill is a disclosed local-history retrieval helper with sensible limits, though users should understand it can read local AI conversation history and may require installing a CLI dependency.

Install only if you are comfortable allowing RecallBase to search local AI conversation history. If rb is missing, verify the npm package and publisher before authorizing a global install, and use the narrowest query that answers your question.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/troubleshooting.md:17

Finding

Unpinned Global Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, line 17
Vulnerability Type: Unpinned dependency installation from a mutable package registry
Risk Level: Medium

Vulnerable Code Snippet:

markdown

If `rb` is not installed, report that prerequisite. Install it only within the user's authorization; the standard package command is `npm install -g recallbase`.

Technical Analysis

The troubleshooting instructions recommend globally installing the latest available version of the recallbase npm package without specifying a reviewed version or verifying package integrity, provenance, publisher identity, or registry origin.

Because an unversioned npm installation resolves to a mutable package release at execution time, the installed artifact may differ from the package that existed when this Skill was audited. A compromised publisher account, registry compromise, or malicious future release could introduce hostile package code. npm packages may execute lifecycle scripts during installation, and the resulting globally installed rb executable subsequently receives access to local conversation-history data as part of the Skill's normal workflow.

The requirement for user authorization reduces the likelihood of silent installation but does not address the dependency's integrity or the risks associated with global installation.

Attack Path

1. An attacker compromises the recallbase package, its publisher account, or its supply-chain release process.
2. The attacker publishes a malicious version as the package version selected by the unpinned installation command.
3. A user encounters a missing rb prerequisite and authorizes the documented command: npm install -g recallbase.
4. npm downloads and installs the malicious release. Malicious lifecycle code may execute during installation with the privileges of the invoking user.
5. The globally installed executable may later b ...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to an explicitly reviewed package version, for example:

   bash

   npm install -g recallbase@<reviewed-version>
   

2. Publish and document the expected package integrity digest or another verifiable artifact signature.
3. Specify the trusted npm registry explicitly and advise users to verify the package publisher, provenance attestations, and release metadata before installation.
4. Prefer a project-local or isolated installation over a global installation where operationally feasible.
5. Disable package lifecycle scripts during installation when the package does not require them:

   bash

   npm install --ignore-scripts recallbase@<reviewed-version>
   

6. If lifecycle scripts are required, review them and all transitive dependencies before recommending execution.
7. Maintain a lockfile or equivalent immutable dependency record where the installation model permits it, and periodically reassess the pinned release for known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep