registry / @maxiaochao/pi-toolkit / 0.10.15

@maxiaochao/pi-toolkit@0.10.15

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic installer makes first-party changes to global pi agent configuration and user-local command files, which warrants a warning. The inspected source does not establish a malicious payload or an unconsented foreign control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall.

Impact

The package can change instructions used by the user's pi agent across projects and add a command-line helper. No confirmed credential theft, remote execution, or broader control hijack was identified.

Mechanism

The hook copies bundled instructions over ~/.pi/agent/AGENTS.md when the file differs, seeds a default theme setting when needed, and installs pi-worktree files under user-local directories.

AI rationale

Evidence

package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-agents.mjs automatically after installation.
The hook writes the bundled AGENTS.md to the user's global ~/.pi/agent directory whenever the existing file differs, and seeds a default theme setting.
The hook also installs the package's pi-worktree command and completion files in user-local directories.
The bundled AGENTS.md contains general coding guidance; inspected flagged files are tests, benchmark utilities, browser setup, and subagent functionality.

Evidence against

The global agent instruction file is first-party content for this toolkit, and the installer has no network or credential-forwarding behavior.
The remaining flagged source excerpts show test setup, benchmark task execution, and subagent reporting rather than a concrete attack.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

15 flagged

package.jsonView file

Lines 45-71json

45 "./themes"

46 ]

47 },

48 "bin": {

49 "pi-worktree": "packages/worktree/bin/pi-worktree"

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-ai": "*",

53 "@earendil-works/pi-coding-agent": "*",

54 "@earendil-works/pi-tui": "*",

55 "typebox": "*"

56 },

57 "dependencies": {

58 "ws": "^8.19.0"

59 },

60 "scripts": {

61 "test": "node tests/package-layout.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/scheduler test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

62 "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts",

63 "eval:agents": "node evaluations/agents-md/run.mjs",

64 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

65 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

66 },

67 "publishConfig": {

68 "access": "public"

69 }

70}

packages/worktree/tests/extension.test.mjsView file

Lines 37-77javascript

37 let releaseExec;

38 let markExecStarted;

39 const execStarted = new Promise(resolve => { markExecStarted = resolve; });

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1384 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.10.14 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.10.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High