registry / @howaboua/pi-durable-web / 0.11.0
@howaboua/pi-durable-web@0.11.0
Codex web search and navigation for Pi Durable
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe scanner’s gated-capability lead is not supported by the activation code: it contains no CI, time, or host fingerprint gate. Network access is part of the advertised web search feature, runs on tool invocation, and strips sensitive headers on cross-origin redirects.
Static reason
One or more suspicious static signals were detected.
Trigger
A host invokes the web search tool.
Impact
The provider performs the requested web search and returns results to the tool.
Mechanism
The tool sends a search request to the resolved Codex-compatible provider using that provider’s authentication.
AI rationale
The scanner’s gated-capability lead is not supported by the activation code: it contains no CI, time, or host fingerprint gate. Network access is part of the advertised web search feature, runs on tool invocation, and strips sensitive headers on cross-origin redirects.
Network endpoints3
chatgpt.com/backend-api (default provider base URL)chat.openai.com (permitted ChatGPT cookie host)chatgpt-staging.com (permitted ChatGPT cookie host)
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entrypoint and a separate component entrypoint; it declares no lifecycle script in the inspected manifest.
- The web search request runs inside the web tool’s execute callback and sends a request to the resolved provider’s search URL.
- The request uses authentication obtained from the configured provider’s model collection or an explicitly supplied provider resolver.
- On cross-origin redirects, the code removes authorization, account ID, cookies, and proxy authorization headers.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
UrlStrings
Source & flagged code
6 flaggeddist/activation.jsView file
312var OPENAI_CODEX_PROVIDER = "openai-codex";
L313: var DEFAULT_CODEX_BASE_URL = "https://chatgpt.com/backend-api";
L314:
...
L332: function codexWebRunUserAgent(originator = CODEX_TOOL_ORIGINATOR) {
L333: const platform = process.platform === "darwin" ? "Mac OS" : process.platform === "win32" ? "Windows" : process.platform === "linux" ? "Linux" : process.platform;
L334: const arch = process.arch === "arm64" ? "arm64" : process.arch;
L335: const terminal = process.env["TERM_PROGRAM"]?.trim() || process.env["TERM"]?.trim() || "unknown";
L336: return originator + "/0.0.0 (" + platform + " unknown; " + arch + ") " + terminal;
...
L491: const reader = response.body.getReader();
L492: const decoder = new TextDecoder;
L493: let total = 0;
...
L676: headers: codexToolProviderHeaders(provider
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/activation.jsView on unpkg · L312457if (nextUrl.origin !== currentUrl.origin) {
baseHeaders.delete("authorization");
baseHeaders.delete("chatgpt-account-id");
baseHeaders.delete("cookie");
baseHeaders.delete("proxy-authorization");
Medium
Stripped Provenance Metadata
On cross-origin redirects, the code removes authorization, account ID, cookies, and proxy authorization headers.
dist/activation.jsView on unpkg · L457Findings
1 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/activation.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/activation.js
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/activation.js
LowAi Review Evidencedist/activation.js
Affected versions and remediation
This report applies to @howaboua/pi-durable-web@0.11.0.
See all versions of @howaboua/pi-durable-web for other recorded verdicts.
- Review the evidence and your use of @howaboua/pi-durable-web@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.