Track which AI agent wrote which lines in a shared Git checkout; each commits only its own lines.
Risky behavior the analysis could not rule out.
Setup installs a git pre-commit hook shim at the repository's effective hooks path, which is a host-config write beyond the MCP tool surface; it is documented, fail-open, and chains any pre-existing hook.
The shim `quilt setup` installs at `.git/hooks/pre-commit`.
Undeclared: the server locates and reads local Claude/Codex session transcripts (~/.claude/projects, ~/.codex) to extract the user's past prompts for attribution, a capability beyond coordination state; no off-host send is seen in this batch.
const root = options.claudeDir ?? process.env.QUILT_CLAUDE_DIR ?? join(homedir(), ".claude", "projects");
The best case against the finding is that the code is read-only and scoped to the actor's own session prefix and the repo cwd, with no network sink in this file. That does not refute it: the server still reads private Claude/Codex transcripts, nothing declares this, and the refutation would rest only on the absence of a chain. The finding stays a contextual risk.
Candidates the review stage examined and rejected, kept for transparency.
The CLI ships an undeclared telemetry subsystem whose daily heartbeat is on by default (opt-out, not opt-in), sending usage data off-host; the destination and payload are not visible in this batch.
Show or change anonymous usage telemetry (daily heartbeat on by default; command events opt-in)
The served telemetry.ts shows the heartbeat posts only an event name, version, platform, node major and a random UUID to PostHog. Nothing user-identifying or content-bearing is sent, and the behavior is openly declared in the command's own description and the setup disclosure. Kill switches are QUILT_TELEMETRY=0, DO_NOT_TRACK and `quilt telemetry off`.
The setup command writes agent control-plane files (.claude/settings.json hooks and CLAUDE.md instructions) and a git pre-commit hook, which the server.json description (tracking authorship) does not mention, although the CLI help text and setup output disclose it.
const settingsPath = join(wsRoot, ".claude", "settings.json");
Writing capture hooks and the CLAUDE.md snippet is the declared purpose of the user-invoked `quilt setup` command, which is documented as a wiring command and supports --dry-run. That is the core capability, not a concealed persistence mechanism.
Ordinary CLI commands send a default-on daily telemetry heartbeat (version, OS, random id) off-host, which is not declared in server.json metadata, though setup prints a disclosure and offers opt-out.
if (name !== "setup") maybeSendHeartbeat();
The heartbeat call on ordinary commands sends only version, platform, node major and a random id, per buildEventPayload. Setup prints an unconditional disclosure that names exactly these fields and the opt-out, so the behavior is neither concealed nor harmful exfiltration.
The onboarding module writes a coordination snippet into agent rules files (CLAUDE.md/AGENTS.md) and wires hooks and MCP config, including the user-global ~/.codex/hooks.json. This is the product's declared setup purpose, but it persistently alters agent control-plane files and steers future agent behavior.
Magical onboarding: detect the agent orchestrator in a repo and wire Quilt in
The module is the product's own setup step. It is explicit about what it writes, and its merges are additive and refuse to touch files that are not valid JSON. It writes only the product's own server entry, hooks and coordination snippet, so this is the declared core capability, not hidden persistence.
Undeclared usage telemetry: a default-on daily heartbeat (version, OS, node version, random id) is POSTed to PostHog via a detached child process, with the endpoint overridable by the QUILT_TELEMETRY_ENDPOINT env var; no declaration covers this, though the payload is coarse and an opt-out exists.
const endpoint = process.env.QUILT_TELEMETRY_ENDPOINT ?? POSTHOG_ENDPOINT;
The payload is a coarse, anonymous heartbeat. It is disclosed to users and can be turned off with QUILT_TELEMETRY=0, DO_NOT_TRACK or `quilt telemetry off`. The endpoint override is an env var that only the local user controls, so no sensitive data is exfiltrated.
`quilt update` spawns an install command (derived from detectInstallManager) with inherited stdio to self-update from the npm registry; it is user-invoked, but the command string comes from update.ts, which is not shown.
const res = spawnSync(argv[0]!, argv.slice(1), { stdio: "inherit" });`quilt update` is an explicit, user-invoked subcommand whose declared purpose is updating Quilt to the latest published version. It does not run silently, and nothing in it contradicts that declaration.
The undeclared repoVisibility helper spawns the external `gh` CLI in the repo to query visibility (skippable with QUILT_NO_GH, 3s timeout); a benign-looking local probe, but not declared.
spawnSync("gh", ["repo", "view", "--json", "visibility", "-q", ".visibility"], {The `gh` call uses fixed arguments with no agent or user input, a 3s timeout and a QUILT_NO_GH opt-out. Its output is reduced to public/private/null. It is a benign local probe with no harmful sink.
The server package ships telemetry that is on by default (a daily heartbeat to a PostHog endpoint with version, OS and a random id), which is not part of its declared coordination purpose; it is anonymous, documented in code, and has an opt-out.
The daily HEARTBEAT (version, OS, random id,
The heartbeat carries only version, OS and a random id. The code states a counts-never-content rule and provides opt-outs, so nothing sensitive leaves the host.
The dashboard page loads fonts from Google Fonts and Fontshare, contradicting the in-code claims 'nothing fetched remotely' and 'No remote state', which leaks the visitor's IP to third parties.
<link href="https://api.fontshare.com/v2/css?f[]=gambetta@500,600,700&f[]=switzer@400,500,600&display=swap" rel="stylesheet">
The page links static font stylesheets that the user's browser fetches. No session or repo data is sent to those hosts, so this is a stale comment, not exfiltration.
Parts of the artifact the static analysis could not fully examine.
unanalyzable_binary binary content is only byte-scannedunanalyzable_binary binary content is only byte-scanned