registry / @markjaquith/agency / 3.25.0
@markjaquith/agency@3.25.0
Manage agentic work across repositories with durable workbases
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook installs a package-owned extension that can affect Pi agent sessions, so this warrants a warning for extension lifecycle risk. The inspected extension behavior is workbase integration; no concrete attack behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook; the extension behavior activates in Pi agent sessions.
Impact
This automatically installs first-party agent extension behavior and allows it to influence Pi sessions associated with Agency workbases. No credential transfer or unrelated network action was identified in the inspected behavior.
Mechanism
The hook copies the bundled extension into the global Pi extension path. The extension runs Agency context commands, discovers workbase skills, and appends workbase instructions to the system prompt.
AI rationale
The postinstall hook installs a package-owned extension that can affect Pi agent sessions, so this warrants a warning for extension lifecycle risk. The inspected extension behavior is workbase integration; no concrete attack behavior was established.
Evidence
package.jsonscripts/install-pi-extension.tspi-extensions/agency.ts
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs the package’s Pi extension installer.
- The installer targets the user’s global Pi extension directory and copies the package-owned extension there.
- The installer preserves existing files unless it can verify its own ownership and file contents.
- The extension adds workbase instructions to Pi’s system prompt and exposes workbase skill paths during agent sessions.
- The integration service also builds configuration paths under the workbase root.
Evidence against
- The extension obtains context by running the package’s own agency command and checks that the workbase context is valid.
- The inspected extension behavior is limited to workbase context, skills, and prompt instructions; no credential transfer or unrelated network endpoint was identified.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = bun scripts/install-pi-extension.ts install
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = bun scripts/install-pi-extension.ts install
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/utils/interactive-loader.tsView file
3const preload = ["@opentui", "solid", "preload"].join("/")
L4: await import(preload)
L5: return import("./interactive")
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/utils/interactive-loader.tsView on unpkg · L3Findings
3 High7 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitednode_modules/@babel/core/lib/config/files/plugins.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/utils/process.ts
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresrc/utils/interactive-loader.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynode_modules/@opentui/core-linux-x64/libopentui.so
MediumShips Wasm Modulenode_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @markjaquith/agency@3.25.0.
See all versions of @markjaquith/agency for other recorded verdicts.
- Review the evidence and your use of @markjaquith/agency@3.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.