registry / @kky42/pievo / 0.8.0

@kky42/pievo@0.8.0

Durable profile evolution and approval dashboard for Pi

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Pi extension activation can collect session entries and send them to its local Evolution Daemon. The daemon persists state and can modify Pievo-owned profiles only through authenticated dashboard approval flows; no confirmed external exfiltration or foreign agent-control mutation was found.

Static reason

No blocking static signals were detected.

Trigger

Pi loads the declared extension and a user starts a session with an enabled Pievo profile.

Impact

Session content is processed locally and may feed the configured Pi model reviewer; approved changes alter Pievo profile memory and skill files.

Mechanism

Automatic Pi-session observation to authenticated loopback daemon with approved profile evolution.

Rationale

Source inspection shows a first-party Pi extension with automatic session observation and local profile-evolution capability, but no lifecycle execution, remote exfiltration, stealth persistence, or unapproved foreign AI-agent configuration changes. Downgrade to warn under the extension lifecycle policy.

Evidence

package.jsonsrc/extension/index.jssrc/extension/observation-client.jssrc/daemon/server.jssrc/core/sdk-reviewer.jssrc/core/profile-service.js~/.pi/evo/state/internal-token~/.pi/evo/state/dashboard-auth.json

Network endpoints1

127.0.0.1:3210/internal/observations

@kky42/pievo@0.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code