@limai.io/cli@0.4.15

CLI and SDK for the LimAI data extraction platform

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The flagged execution is local Git metadata lookup or an explicit self-update, while credential use follows the configured LimAI API settings. I found no install-time behavior or automatic transfer of credentials to an unrelated destination.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

SDK requests occur when a caller uses the client; update checks and installs occur only when a user invokes `limai update`.

Impact

Normal LimAI API operations and an explicitly requested CLI update; no unauthorized collection or execution identified.

Mechanism

The client sends its configured token to its configured API URL. Workspace-aware configuration uses local Git metadata and LimAI development settings.

AI rationale

Evidence

~/.limai/config.json<repo>/.limai.token<repo>/tables/.env.local

Network endpoints5

registry.npmjs.orgconfigured LimAI API URLconfigured LimAI SSE URL${e}tables.localhost${e}ws.localhost

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a LimAI SDK entry point and a `limai` CLI; its only lifecycle script is `prepublishOnly`, which runs the build.
The HTTP client sends its configured LimAI token as a bearer token in requests built from the configured API URL.
Workspace detection runs `git rev-parse` to identify the LimAI checkout and reads its `tables/.env.local` to derive local API and SSE URLs.
The npm install command is inside the explicitly invoked `update` command and installs this package from npm.
The CLI uses the normal argument parser; the manifest exposes the SDK separately from the CLI.

Evidence against

The flagged child-process use is limited to local Git metadata discovery and the user-invoked package updater.
The credential and environment handling follows the LimAI client’s configured API, token, and local development settings; I found no automatic transfer to an unrelated host.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Source & flagged code

6 flagged

dist/index.jsView file

1"use strict";var _e=Object.create;var ot=Object.defineProperty;var Ne=Object.getOwnPropertyDescriptor;var Le=Object.getOwnPropertyNames;var Me=Object.getPrototypeOf,Fe=Object.proto... L2: `)===-1&&p.indexOf("\r")===-1){r.push(p);return}r.push(p);let c=r.join("");r.length=0;let m=w(c);m!==""&&r.push(m)}function w(p){let c=0;if(p.indexOf("\r")===-1){let m=p.indexOf(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: "use strict";var _e=Object.create;var ot=Object.defineProperty;var Ne=Object.getOwnPropertyDescriptor;var Le=Object.getOwnPropertyNames;var Me=Object.getPrototypeOf,Fe=Object.proto... L2: `)===-1&&p.indexOf("\r")===-1){r.push(p);return}r.push(p);let c=r.join("");r.length=0;let m=w(c);m!==""&&r.push(m)}function w(p){let c=0;if(p.indexOf("\r")===-1){let m=p.indexOf(`

Findings

2 Critical4 High3 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @limai.io/cli@0.4.15.

See all versions of @limai.io/cli for other recorded verdicts.

Review the evidence and your use of @limai.io/cli@0.4.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 03:13:07.617Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @limai.io/cli / 0.4.15

@limai.io/cli@0.4.15

CLI and SDK for the LimAI data extraction platform

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

SDK requests occur when a caller uses the client; update checks and installs occur only when a user invokes `limai update`.

Impact

Normal LimAI API operations and an explicitly requested CLI update; no unauthorized collection or execution identified.

Mechanism

The client sends its configured token to its configured API URL. Workspace-aware configuration uses local Git metadata and LimAI development settings.

AI rationale

Evidence

~/.limai/config.json<repo>/.limai.token<repo>/tables/.env.local

Network endpoints5

registry.npmjs.orgconfigured LimAI API URLconfigured LimAI SSE URL${e}tables.localhost${e}ws.localhost

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a LimAI SDK entry point and a `limai` CLI; its only lifecycle script is `prepublishOnly`, which runs the build.
The HTTP client sends its configured LimAI token as a bearer token in requests built from the configured API URL.
Workspace detection runs `git rev-parse` to identify the LimAI checkout and reads its `tables/.env.local` to derive local API and SSE URLs.
The npm install command is inside the explicitly invoked `update` command and installs this package from npm.
The CLI uses the normal argument parser; the manifest exposes the SDK separately from the CLI.

Evidence against

The flagged child-process use is limited to local Git metadata discovery and the user-invoked package updater.
The credential and environment handling follows the LimAI client’s configured API, token, and local development settings; I found no automatic transfer to an unrelated host.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Source & flagged code

6 flagged

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

2 Critical4 High3 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @limai.io/cli@0.4.15.

See all versions of @limai.io/cli for other recorded verdicts.

Review the evidence and your use of @limai.io/cli@0.4.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 03:13:07.617Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.