registry / AI-agent capability abuse / delimit-cli / 4.20.0

delimit-cli@4.20.0

The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The package has a concrete user-invoked capability to alter AI-agent configuration, including automatic acceptance in non-interactive setup. The inspected install hook does not perform that mutation and sends telemetry only when enabled, so blocking is not supported.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the setup command; non-interactive setup accepts hook installation by default.

Impact

This can alter later AI-agent behavior in configured accounts, but static inspection did not show credential theft, remote code loading, or covert installation.

Mechanism

The setup code detects AI tools, invokes their hook installers, and writes a managed Delimit instruction section for Codex.

AI rationale

Evidence

bin/delimit-setup.jslib/cross-model-hooks.js~/.codex/instructions.md

Network endpoints1

delimit.ai/api/telemetry

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit setup program defaults to installing hooks when non-interactive.
Setup dispatches hook installation to every detected AI tool.
The Codex hook installer replaces or appends a managed instruction block and writes it to the instructions file.
The install lifecycle network request is disabled unless an affirmative telemetry environment value is set.

Evidence against

No confirmed secret exfiltration, remote payload execution, or install-time agent configuration write was found.
The configuration changes are reached through setup behavior rather than the postinstall hook.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 895 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.lemonsqueezy.com, api.meta.ai, api.openai.com, api.x.ai, app.delimit.ai, delimit.ai, generativelanguage.googleapis.com, github.com, img.shields.io, jsonfeed.org, python.org, registry.npmjs.org, us-central1-aiplatform.googleapis.com

Source & flagged code

26 flagged

package.jsonView file

Lines 146-186json

146 "gateway/tasks/check_policy_v2.py",

147 "gateway/tasks/check_policy_v3.py",

148 "gateway/tasks/explain_diff.py",

149 "gateway/tasks/explain_diff_v2.py",

150 "gateway/tasks/validate_api.py",

151 "gateway/tasks/validate_api_v2.py",

152 "gateway/tasks/validate_api_v3.py",

153 "scripts/postinstall.js",

154 "scripts/muse_mcp.py",

155 "server.json",

156 "README.md",

157 "LICENSE",

158 "CHANGELOG.md",

159 "gateway/ai/session_continuity.py"

160 ],

161 "bin": {

162 "delimit": "./bin/delimit-cli.js",

163 "delimit-cli": "./bin/delimit-cli.js"

164 },

165 "scripts": {

166 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L166

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L166

167 "sync-gateway": "bash scripts/sync-gateway.sh",

168 "prepublishOnly": "node scripts/clean-tree-guard.js && bash scripts/publish-ci-guard.sh && bash scripts/check-bundle-classification.sh && bash scripts/gateway-clean-guard.sh && npm run sync-gateway && bash scripts/build-proprietary-core.sh license_core && bash scripts/build-proprietary-core.sh deliberation && bash scripts/security-check.sh && bash scripts/check-bundle-parity.sh",

169 "version": "node scripts/sync-version-sources.js",

170 "test": "node scripts/test-with-config-guard.js",

171 "test:raw": "node --test tests/mcp-subcommand.test.js tests/claude-plugin-structure.test.js tests/clean-tree-guard.test.js tests/_config-sentinel.test.js tests/setup-onboarding.test.js tests/setup-matrix.test.js tests/setup-no-clobber.test.js tests/setup-env-preservation.test.js tests/config-export-import.test.js tests/cross-model-hooks.test.js tests/golden-path.test.js tests/v420-features.test.js tests/v43-wrap-engine.test.js tests/v43-trust-page-engine.test.js tests/v43-ai-sbom-engine.test.js tests/attest-mcp.test.js tests/delimit-home.test.js tests/led5658-cli-remember-isolation.test.js ...

172 },

173 "keywords": [

174 "openapi",

175 "swagger",

176 "api",

177 "breaking-changes",

178 "semver",

179 "lint",

180 "linter",

181 "api-governance",

182 "api-contracts",

183 "ci-cd",

184 "github-actions",

185 "migration",

186 "diff",

Long lines were clipped for display.

bin/delimit-setup.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * delimit setup — Install Delimit MCP governance tools into Claude Code.

4 *

5 * What it does:

6 * 1. Creates ~/.delimit/ directory with the MCP server + core engine

7 * 2. Adds "delimit" to Claude Code's MCP config (~/.mcp.json or .mcp.json)

8 * 3. Installs default agents into ~/.claude/agents/

9 * 4. Prints next steps

10 */

11const

lib/proxy-handler.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Delimit Proxy Handler - Intercepts AI tool commands

5 * This module wraps AI tools (claude, gemini, codex) with governance

6 */

8const { spawn } = require('child_process');

9const

bin/delimit-cli.jsView file

Lines 52-92javascript

52 try { return require('../package.json').version; } catch { return 'unknown'; }

53})();

55const continuityContext = resolveContinuityContext();

lib/cross-model-hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ion migratetonestedformat(hookgroup) { if (hookgroup.hooks && array.isarray(hookgroup.hooks)) { return hookgroup; } const nested = { matcher: hookgroup.matcher || '' }; if (hookgroup.if) nested.if = hookgroup.if; nested.hooks = [{ type: hookgroup.type || 'command', command: hookgroup.command }]; return nested; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/cross-model-hooks.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/cross-model-hooks.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cross-model-hooks.jsView on unpkg

lib/auth-setup.jsView file

11Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> lib/auth-setup.js L11: const crypto = require('crypto'); L12: const { execSync } = require('child_process'); L13: const chalk = require('chalk'); ... L16: constructor() { L17: this.configDir = path.join(process.env.HOME, '.delimit'); L18: this.credentialsFile = path.join(this.configDir, 'credentials.enc'); ... L183: console.log(chalk.gray('\n Required scopes for full functionality:')); L184: console.log(chalk.gray(' • repo (Full control of private repositories)')); L185: console.log(chalk.gray(' • workflow (Update GitHub Action workflows)')); ... L281: L282: mcp[server].endpoint = await this.prompt(' Endpoint URL (http://localhost:8080): ', 'http://localhost:8080'); L283: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/auth-setup.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/auth-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth-setup.jsView on unpkg

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 2781480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/agent.js#virtual:normalized:round1View on unpkg

lib/hooks-installer.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/hooks-installer.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hooks-installer.jsView on unpkg

lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/agent.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/agent.jsView on unpkg

lib/api-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/api-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/api-engine.jsView on unpkg

lib/attest-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/attest-mcp.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/attest-mcp.jsView on unpkg

lib/wrap-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/wrap-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/wrap-engine.jsView on unpkg

bin/delimit.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = bin/delimit.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit.jsView on unpkg

lib/session-shell.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/session-shell.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/session-shell.jsView on unpkg

lib/delimit-template.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/delimit-template.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/delimit-template.jsView on unpkg

lib/platform-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/platform-adapters.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/platform-adapters.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

Findings

1 Critical21 High8 Medium5 Low

CriticalAi Agent Control Hijackbin/delimit-cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/delimit-setup.js

HighShell

HighSame File Env Network Executionlib/proxy-handler.js

HighSandbox Evasion Gated Capabilitybin/delimit-setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js

HighTrigger Reachable Persistencelib/auth-setup.js

HighRuntime Package Installbin/delimit-setup.js

HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/auth-setup.js

Affected versions and remediation

This report applies to delimit-cli@4.20.0.

See all versions of delimit-cli for other recorded verdicts.

Review the evidence and your use of delimit-cli@4.20.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:48:27.571Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code