delimit-cli@4.22.0
Keep the state. Change the model. Shared context and a multi-model panel across Claude Code, Codex, Cursor, Antigravity, GitHub Copilot, and Muse.
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection supports a warning for user-invoked agent configuration changes and global hook installation, not a block. The primary CLI file remains unreadable, but independently inspected setup code establishes the warning-level capability.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the setup script; in noninteractive mode, detected assistant hooks are enabled by default. The separate hooks installer runs when invoked directly.
Impact
Later assistant sessions and Git operations can be affected by the installed governance hooks. No concrete malicious behavior was confirmed in these setup operations.
Mechanism
Setup writes assistant instructions and hook configuration, including managed Cursor rules. The separate installer creates executable Git hooks and changes global Git configuration.
AI rationale
Source inspection supports a warning for user-invoked agent configuration changes and global hook installation, not a block. The primary CLI file remains unreadable, but independently inspected setup code establishes the warning-level capability.
Evidence
bin/delimit-setup.jslib/cross-model-hooks.jsadapters/cursor-rules.jslib/hooks-installer.js~/.codex/instructions.md~/.cursor/rules/delimit.mdglobal Git core.hooksPath
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js; its telemetry send is gated by affirmative DELIMIT_TELEMETRY and targets delimit.ai.
- The setup script describes its configuration changes and asks to proceed interactively; when noninteractive, it enables hook installation by default and calls the installer for detected assistants.
- The hook setup writes Delimit instructions into assistant configuration, while Cursor rules use a managed section that preserves surrounding user content.
- The inspected integration targets identify assistant configuration locations; the harness target reads project instruction files to enforce a size bound. The primary CLI excerpt checks existing MCP configuration, but the full file is unreadable.
- A separate directly invoked hooks installer writes executable Git hooks and sets the global core.hooksPath.
Evidence against
- The install hook does not automatically modify assistant configuration; those changes are in a separate setup path.
- The inspected setup code installs first-party governance instructions and hooks; it does not establish credential collection or malicious payload execution.
- The primary bin file contains NUL bytes and could not be fully inspected, so its remaining behavior is unresolved.
Source & flagged code
26 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/delimit-setup.jsView file
12const path = require('path');
L13: const { execSync, execFileSync } = require('child_process');
L14: const os = require('os');
High
Child Process
Package source references child process execution.
bin/delimit-setup.jsView on unpkg · L12Findings
1 Critical21 High8 Medium5 Low
CriticalAi Agent Control Hijackbin/delimit-cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/delimit-setup.js
HighShell
HighSame File Env Network Executionlib/proxy-handler.js
HighSandbox Evasion Gated Capabilitybin/delimit-setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js
HighTrigger Reachable Persistencelib/auth-setup.js
HighRuntime Package Installbin/delimit-setup.js
HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/auth-setup.js
Affected versions and remediation
This report applies to delimit-cli@4.22.0.
See all versions of delimit-cli for other recorded verdicts.
- Review the evidence and your use of delimit-cli@4.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.