delimit-cli@4.24.0
BLOCKED· startup onlyPublisher claims: "Keep the state. Change the model. Shared context and a multi-model panel across Claude Code, Codex, Cursor, Antigravity, GitHub Copilot, and Muse." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher delimit-ai · publishing for 253 daysInstalls 6,870Last detonated 28 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Revoked: guards refuse to launch this version
confirmed incident: read ~/.config/gh/hosts.yml Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.
Before you give it your token
- It will ask for
ANTHROPIC_API_KEYDELIMIT_AUTH_TOKENDELIMIT_TELEGRAM_BOT_TOKENGOOGLE_APPLICATION_CREDENTIALSMETA_API_KEYMODEL_API_KEYOPENAI_API_KEYRAPIDAPI_KEYXAI_API_KEYConfiguration, not credentials: _DELIMIT_TEST_ONLY_REAL_HOME, CIRCLECI, CODEX_HOME, CODEX_INTERNAL_ORIGINATOR_OVERRIDE, DELIMIT_AGENT_PORT, DELIMIT_AGENT_URL, DELIMIT_ALLOW_TEST_RECIPIENTS, DELIMIT_ALLOWED_REPOS, DELIMIT_API_FALLBACK, DELIMIT_CHAT_RUN_ID, DELIMIT_CLAUDE_TASK_ROOTS, DELIMIT_CONTINUITY_ROOT, DELIMIT_DEBUG, DELIMIT_DEBUG_CONTINUITY, DELIMIT_ENGINE_DIR, DELIMIT_FILE_PATH, DELIMIT_FORWARD_TO, DELIMIT_FOUNDER_SENDERS, DELIMIT_GATEWAY_ROOT, DELIMIT_HANDOFF_ID, DELIMIT_HEARTBEAT_DIR, DELIMIT_HOME, DELIMIT_IMAP_HOST, DELIMIT_IMAP_PORT, DELIMIT_IMAP_USER, DELIMIT_LAUNCH_DIR, DELIMIT_MODE, DELIMIT_MODEL, DELIMIT_MULTI_USER, DELIMIT_NAMESPACE_ROOT, DELIMIT_NO_AUTO_UPDATE- Where it talks to
- delimit.ai (its own)Also x.ai, lemonsqueezy.com, python.org, shields.io, telegram.org, x.com, cyclonedx.org, meta.ai, jsonfeed.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- read ~/.config/gh/hosts.yml · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 30/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 29 s · 3 scenariost+CategoryObserved action
0.0sprocessinstall script run in the sandbox
8.3sprocessdependency install exit 0
28sfilesystemread ~/.config/gh/hosts.yml
28sfilesystemread ~/.delimit/known_workspaces.json · ~ outside project
28sclaimedstartup only: exited (0) before answering · ○ Policy — npx delimit-cli init ○ CI gate — npx delimit-cli ci ○ Git hooks — npx delimit-cli hooks install ○ MCP tools — npx delimit-cli setup
28sprocessscript backend runs setup only
28sprocesssecond launch, clock +45 days, CI unset
Static findings
HIGH
Access to sensitive file pathsbin/delimit-cli.js:1883 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const envFiles = ['.env', '.env.local', '.env.production'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/delimit-setup.js:515 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...(cursorConfig.mcpServers.delimit?.env || {}), PYTHONPATH: path.join(DELIMIT_HOME, 'server') }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/delimit-cli.js:1882 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Check for .env files committed (not in .gitignore)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/delimit-setup.js:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05...(mcpConfig.mcpServers.delimit?.env || {}),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/delimit-setup.js:584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...(antigravityConfig.mcpServers.delimit?.env || {}), PYTHONPATH: path.join(DELIMIT_HOME, 'server') }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Image alt text carrying instructionsREADME.md:41 · Image alt text carrying instructions
AST01Terminal recording: npx delimit-cli remember "Auth uses session cookies, not JWT. Decided after the token-leak review." prints "Remembered. (1 memory total)", tFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsbin/delimit-setup.js:473 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05inDelimitEnv = /^\s*\[mcp_servers\.delimit\.env\]\s*$/.test(line);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbin/delimit-setup.js:544 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...(geminiConfig.mcpServers.delimit?.env || {}), PYTHONPATH: path.join(DELIMIT_HOME, 'server') }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationbin/delimit-setup.js:949 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06# Auto-update in background (non-blocking)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedgateway/ai/continuity.py:142 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Auto-update or dynamic fetch configurationgateway/ai/hot_reload.py:489 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06target=self._loop, name="delimit-hot-reload", daemon=TrueFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/delimit-setup.js:1340 · npx invocation of non-well-known package — may execute untrusted code
AST06log(` Try: ${bold(`npx delimit-cli lint ${detectedSpecs[0]}`)}`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/delimit-setup.js:833 · File type combined with upload action — agent may exfiltrate local data files
AST07// Silent: auto-detect API keys and configure models.json (no output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebin/delimit-cli.js:2118 · npx invocation of non-well-known package — may execute untrusted code
AST06body: 'The weekly drift monitor detected changes to the API spec that have not been reviewed through governance. Run npx delimit-cli lint to review.',Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationgateway/ai/hot_reload.py:502 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06_singleton: Optional[HotReloadWatcher] = NoneFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/delimit-cli.js:2179 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.gray(' Zero-Spec extraction skipped — run `npx delimit-cli lint` manually'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detectedbin/delimit-cli.js:4360 · Unicode escape sequence detected — may contain obfuscated payloads
AST07console.log(chalk.gray(' \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500'));Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedgateway/ai/governance.py:1120 · Python subprocess execution detected
AST05issue_proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsgateway/ai/pii_redact.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(r'''(?i)process\.env\.[A-Za-z0-9_]*(?:key|secret|token|passw(?:or)?d|pwd|credential)[A-Za-z0-9_]*\s*(?:\|\||\?\?)\s*["'`](?P<v>[^"'`\s]{8,})["'`]''', "secret env default"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedgateway/ai/data_plane.py:21 · Python subprocess execution detected
AST05subprocess.run(["which", "gh"], capture_output=True).returncode == 0Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagebin/delimit-cli.js:2176 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(chalk.gray(' Zero-Spec extraction skipped — run `npx delimit-cli lint` manually'));Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/delimit-cli.js:4179 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(JSON.stringify(output, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedgateway/ai/governance.py:1161 · Python subprocess execution detected
AST05comments_proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagebin/delimit-cli.js:1707 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(` Run ${chalk.bold('npx delimit-cli lint')} to check your API.\n`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandbin/delimit-setup.js:1114 · File permission modification command — agent changes file ownership/permissions
AST05// legacy template's config chmod or background auto-updater.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagebin/delimit-setup.js:1501 · npx invocation of non-well-known package — may execute untrusted code
AST06log(` ${green('npx delimit-cli doctor')} ${dim('— verify the setup')}`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbin/delimit-cli.js:3772 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Privileged sudo commandgateway/ai/continuity.py:90 · Privileged sudo command — agent may execute with elevated privileges
AST05a legitimate `su`/`sudo -u` context where the passwd home actually DOESFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Unicode escape sequence detectedbin/delimit-cli.js:4381 · Unicode escape sequence detected — may contain obfuscated payloads
AST07console.log(chalk.gray(' \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500'));Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
URL with embedded credentialslib/auth-setup.js:655 · URL with embedded credentials — may be phishing or credential leaking
AST07const credContent = `https://${github.username}:${github.token}@github.com\n`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/delimit-setup.js:1503 · npx invocation of non-well-known package — may execute untrusted code
AST06log(` ${dim('Docs: https://delimit.ai/docs/quickstart (API release safety:')} ${blue('npx delimit-cli demo')}${dim(')')}`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandbin/delimit-setup.js:1316 · File permission modification command — agent changes file ownership/permissions
AST05log(` ${yellow('⚠')} ~/.delimit/ is world-readable/writable (${mode}) — consider: chmod 700 ~/.delimit`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagebin/delimit-cli.js:2107 · npx invocation of non-well-known package — may execute untrusted code
AST06npx delimit-cli lint ${specPath} ${specPath} --baselineFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationgateway/ai/hot_reload.py:53 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06"ai.hot_reload", # don't reload selfFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandgateway/ai/governance.py:1077 · Process kill command — agent can terminate processes
AST05fail-soft behavior so one bad LED doesn't kill the whole tick.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandbin/delimit-setup.js:903 · File permission modification command — agent changes file ownership/permissions
AST05[ -f "$HOME/.codex/config.toml" ] && chmod 644 "$HOME/.codex/config.toml" 2>/dev/nullFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedgateway/ai/data_plane.py:29 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Hidden zero-width characters detectedlib/managed-section.js:61 · Hidden zero-width characters detected — may conceal content
AST07const existing = rawExisting.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File type combined with upload actionbin/delimit-cli.js:3770 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Telegram Bot API URLgateway/ai/notify.py:589 · Telegram Bot API URL — data will be sent to Telegram
AST07url = f"https://api.telegram.org/bot{bot_token}/sendMessage"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
npx invocation of non-well-known packagebin/delimit-setup.js:1499 · npx invocation of non-well-known package — may execute untrusted code
AST06log(` ${green('npx delimit-cli remember "Rejected Redis for sessions: no persistence guarantee on our plan"')}`);Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationgateway/ai/hot_reload.py:46 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06LOG_FILE = LOG_DIR / "hot_reload.jsonl"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationgateway/ai/hot_reload.py:27 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06are logged to ~/.delimit/logs/hot_reload.jsonl and never crash the server.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbin/delimit-cli.js:6789 · Process kill command — agent can terminate processes
AST05console.log(chalk.yellow(` ⚠ kill switch fired — wrapped command exceeded --max-time`));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionbin/delimit-cli.js:4423 · File type combined with upload action — agent may exfiltrate local data files
AST07const parsed = specPath.endsWith('.json') ? JSON.parse(content) : yaml.load(content); // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted inputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbin/delimit-cli.js:2474 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.gray(' 5. Posts remediation guide on the PR'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagelib/cross-model-hooks.js:416 · npx invocation of non-well-known package — may execute untrusted code
AST06npxCmd = 'npx delimit-cli';Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesbin/delimit-setup.js:612 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01log(` • Update CLAUDE.md with Delimit instructions`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:1211 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- Add social scanning instruction to CLAUDE.md template (99531620)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:1239 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- auto-update CLAUDE.md with marker-based upsert (LED-006) (7b46a68a)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Unpinned dependencylib/cross-model-hooks.js:1861 · Unpinned dependency
AST06lines.push(`[Delimit] Auto-update failed. Run: npm install -g delimit-cli@latest`);Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:1436 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- release: v3.11.4 — CLAUDE.md auto-update with versioned markers (66db96dd)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagelib/cross-model-hooks.js:332 · npx invocation of non-well-known package — may execute untrusted code
AST06const bare = commandSubstring.replace(/^npx /, '');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandlib/claude-plugin-server.cjs:124 · File permission modification command — agent changes file ownership/permissions
AST05// Do NOT chmod pre-existing files or directories on users' machinesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandlib/claude-plugin-server.cjs:144 · File permission modification command — agent changes file ownership/permissions
AST05// Ignore chmod failures on platforms without POSIX permissions (e.g. Windows)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Unpinned dependencylib/cross-model-hooks.js:1857 · Unpinned dependency
AST06execS('npm install -g delimit-cli@latest 2>/dev/null', { timeout: 30000, stdio: 'pipe' });Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:1317 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- update: README + CLAUDE.md + description to governance toolkit positioning (832a961a)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagelib/api-engine.js:96 · npx invocation of non-well-known package — may execute untrusted code
AST06`Python dependency missing. Run: npx delimit-cli setup\n\nDetails: ${stderr.trim()}`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandlib/auth-signin.js:101 · File permission modification command — agent changes file ownership/permissions
AST05// mode; explicitly chmod to be safe (no-op on most platforms but cheap).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandlib/auth-signin.js:97 · File permission modification command — agent changes file ownership/permissions
AST05// chmod runs.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Unpinned dependencybin/delimit-setup.js:200 · Unpinned dependency
AST06execSync('npm install -g delimit-cli@latest 2>/dev/null', { stdio: 'pipe', timeout: 30000 });Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.MEDIUM
npx invocation of non-well-known packagelib/cross-model-hooks.js:497 · npx invocation of non-well-known package — may execute untrusted code
AST06echo "Governance: not initialized -- run npx delimit-cli init"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/cross-model-hooks.js:409 · npx invocation of non-well-known package — may execute untrusted code
AST06// Use local binary if installed, fall back to npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandlib/claude-plugin-server.cjs:114 · File permission modification command — agent changes file ownership/permissions
AST05* Do NOT chmod pre-existing files or directories on users' machinesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagelib/api-engine.js:63 · npx invocation of non-well-known package — may execute untrusted code
AST06' npx delimit-cli setup # full install with MCP server',Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedgateway/ai/key_resolver.py:88 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandlib/claude-plugin-server.cjs:171 · File permission modification command — agent changes file ownership/permissions
AST05// Do NOT chmod pre-existing files or directories on users' machinesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedgateway/ai/mcp_bridge.py:31 · Python subprocess execution detected
AST05self._proc = subprocess.Popen( # nosec B-subprocess_shell: MCP bridge spawns user-configured CLI via shell; argv validated upstreamFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filesbin/delimit-setup.js:734 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01// Step 5: Create/update CLAUDE.md and platform instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:1433 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- Update CLAUDE.md template branding and GitHub URL (9fac51be)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagegateway/core/explainer.py:346 · npx invocation of non-well-known package — may execute untrusted code
AST06lines.append("> **Fix locally:** `npx delimit-cli lint`")Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagelib/cross-model-hooks.js:331 · npx invocation of non-well-known package — may execute untrusted code
AST06// Match both "npx delimit-cli X" and "delimit-cli X" variantsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandlib/wrap-engine.js:348 · Process kill command — agent can terminate processes
AST05maxTimeSeconds = 0, // LED-1052: 0 disables kill switchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Prompt injection attemptCHANGELOG.md:1743 · Prompt injection attempt — model control tokens · informational: not an instruction file
AST01- **LED-305**: [P0] [SYSTEM] Fix [email protected] IMAP/SMTP authentication failureFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File permission modification commandlib/claude-plugin-server.cjs:116 · File permission modification command — agent changes file ownership/permissions
AST05* Directories created by the plugin get mode 0700 (mkdir with mode, then chmod to defeat umask).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionlib/auth-setup.js:186 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.gray(' • write:packages (Upload packages to GitHub Package Registry)'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈72 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for delimit-cli@4.24.0 as of 28 h ago. This is the package itself, not its dependencies.
What would make this Verified
50 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
- Unclaimed publisher≈ +8 on the totalClaim delimit-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim delimit-aiPropose a patch to the maintainer