@maxiaochao/pi-toolkit@0.10.12
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest runs an automatic postinstall that performs first-party Pi configuration and CLI setup, so a warning is appropriate under the agent setup policy. The inspected findings do not establish a concrete malicious chain or attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook.
Impact
It can change user-level Pi agent configuration and install user-level command files.
Mechanism
The hook syncs bundled AGENTS.md when absent or different, creates default settings only when absent, and installs the package's worktree CLI and completion files.
AI rationale
The manifest runs an automatic postinstall that performs first-party Pi configuration and CLI setup, so a warning is appropriate under the agent setup policy. The inspected findings do not establish a concrete malicious chain or attack.
Evidence
scripts/install-agents.mjspackages/worktree/scripts/install.mjs
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook runs scripts/install-agents.mjs automatically.
- That script targets the user's ~/.pi/agent/AGENTS.md and settings.json and invokes worktree installation.
- The worktree installer copies its CLI and completion file into the user's home directories.
- The reviewed similarity-flagged files contain test, benchmark, browser-launch, and subagent code; the inspected excerpts show no concrete attack behavior.
Evidence against
- The postinstall hook automatically writes package-owned agent guidance and a default theme when applicable, so installation changes agent configuration and user-level files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
56L57: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L58: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L56scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical11 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.12.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.