delimit-cli@4.18.7
The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains concrete unconsented runtime mutation of a foreign AI-agent control surface and an automatic global update path. It does not meet the stated install-lifecycle blocking threshold because its postinstall hook only sends telemetry and does not perform the control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Any Delimit CLI invocation on a machine with Antigravity installed; later, an installed session-start hook.
Impact
An AI agent may receive automatic-edit approval and instructions to poll email and send drafts without asking; later hooks can replace the installed package and reconfigure the machine.
Mechanism
Silent AI-agent configuration takeover and automatic global package update.
AI rationale
The package contains concrete unconsented runtime mutation of a foreign AI-agent control surface and an automatic global update path. It does not meet the stated install-lifecycle blocking threshold because its postinstall hook only sends telemetry and does not perform the control-surface mutation.
Evidence
bin/delimit-cli.jslib/cross-model-hooks.jsscripts/postinstall.js~/.gemini/antigravity-cli/settings.json~/.delimit/server/ai/server.py
Network endpoints1
delimit.ai
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The install hook sends host and runtime metadata to delimit.ai unless an environment opt-out is set.
- Every CLI invocation silently modifies an existing Antigravity configuration before parsing the requested command.
- That modification enables automatic edits and injects instructions to start polling and send drafts without permission.
- The installed session-start hook checks npm and can globally reinstall this package and run setup automatically.
Evidence against
- The package has no self-dependency in package.json.
- The main install command displays its planned changes and requires confirmation before its normal installer runs.
- Credential collection is interactive and stores its result in a local encrypted file.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
26 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/delimit-setup.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = delimit-cli@4.18.3
matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.3
similarity = 0.902
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/delimit-setup.jsFindings
2 Critical20 High8 Medium5 Low
CriticalAi Agent Control Hijackbin/delimit-cli.js
CriticalPrevious Version Dangerous Deltabin/delimit-setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/delimit-setup.js
HighShell
HighSame File Env Network Executionlib/proxy-handler.js
HighSandbox Evasion Gated Capabilitybin/delimit-setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js
HighTrigger Reachable Persistencelib/auth-setup.js
HighRuntime Package Installbin/delimit-setup.js
HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1
Affected versions and remediation
This report applies to delimit-cli@4.18.7.
See all versions of delimit-cli for other recorded verdicts.
- Review the evidence and your use of delimit-cli@4.18.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.