registry / @markjaquith/agency / 3.2.10

@markjaquith/agency@3.2.10

Manage agentic work across repositories with durable workbases

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically places an Agency extension in Pi's global extension directory. That extension can modify Pi session prompts when it detects a validated Agency workbase.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall after installing the package

Impact

Pi sessions in Agency workbases receive package-controlled context and local instruction text.

Mechanism

global Pi extension installation and prompt augmentation

Rationale

The package automatically mutates a global AI-agent extension surface, so it warrants a warning. The inspected implementation is transparent and package-owned, with no evidence of malware behavior.

Evidence

package.jsonscripts/install-pi-extension.tspi-extensions/agency.ts~/.pi/agent/extensions/agency.ts

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The postinstall hook automatically runs an extension installer.
The installer copies package code into Pi's global agent-extension directory.

@markjaquith/agency@3.2.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code