registry / @davidorex/pi-context / 0.32.0

@davidorex/pi-context@0.32.0

Schema-driven project state management for Pi

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This Pi extension activates at runtime, adds guidance and project-state tools, and checks its package family for updates. Its project writes are command/tool-driven; no malicious chain is confirmed.

Static reason

No blocking static signals were detected.

Trigger

Pi extension load/session start; project mutations require registered tool or /context command use.

Impact

Can modify the active project's Pi-context substrate when invoked; session start may contact npm registry.

Mechanism

Pi extension registration with scoped project-state file operations and update check.

Rationale

The package lacks install hooks, exfiltration, remote code execution, and unscoped destructive behavior. A warning is appropriate for its automatic Pi extension lifecycle and project-write capability.

Evidence

package.jsondist/index.jsdist/update-check.jsdist/context-dir.jsdist/ops-registry.jsdist/object-store.js.pi-context.json.pi-context-registry.json<contextDir>/config.json<contextDir>/schemas/<contextDir>/objects/archive/<contextDir>/

Network endpoints1

registry.npmjs.org/@davidorex/pi-project-workflows/latest

@davidorex/pi-context@0.32.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code