@howaboua/pi-durable-web
Codex web search and navigation for Pi Durable
This report shows the evidence for @howaboua/pi-durable-web@0.11.0. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 33m ago · by lpm-firewall-aiThe scanner’s gated-capability lead is not supported by the activation code: it contains no CI, time, or host fingerprint gate. Network access is part of the advertised web search feature, runs on tool invocation, and strips sensitive headers on cross-origin redirects.
Decision evidence
public snapshot- The manifest exposes a library entrypoint and a separate component entrypoint; it declares no lifecycle script in the inspected manifest.
- The web search request runs inside the web tool’s execute callback and sends a request to the resolved provider’s search URL.
- The request uses authentication obtained from the configured provider’s model collection or an explicitly supplied provider resolver.
- On cross-origin redirects, the code removes authorization, account ID, cookies, and proxy authorization headers.
Source & flagged code
6 flaggedSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/activation.jsView on unpkg · L312On cross-origin redirects, the code removes authorization, account ID, cookies, and proxy authorization headers.
dist/activation.jsView on unpkg · L457Findings
Affected versions and remediation
This report applies to @howaboua/pi-durable-web@0.11.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @howaboua/pi-durable-web@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.