registry / @maxiaochao/pi-toolkit / 0.10.20
@maxiaochao/pi-toolkit@0.10.20
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package automatically writes to its own Pi agent configuration and installs its own command during postinstall, creating a guarded package-owned agent setup risk. The inspected source does not establish a concrete attack or justify blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook.
Impact
This changes agent guidance and user command setup without an explicit setup command. The inspected behavior is scoped to this package’s own Pi integration; no concrete attack was established.
Mechanism
The hook synchronizes bundled AGENTS.md guidance under ~/.pi/agent, supplies a default theme when missing, and calls an installer that copies pi-worktree and its completion into user-local directories.
AI rationale
The package automatically writes to its own Pi agent configuration and installs its own command during postinstall, creating a guarded package-owned agent setup risk. The inspected source does not establish a concrete attack or justify blocking publication.
Evidence
package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-agents.mjs automatically during postinstall.
- The hook targets ~/.pi/agent/AGENTS.md and settings.json; it writes the bundled agent guidance when the file is missing or differs, and sets a default theme when none is configured.
- The hook also installs this package’s pi-worktree command and shell completion into the user’s local bin and completion directories.
- The named test, benchmark, browser, and subagent files contain test setup, caller-supplied command handling, local browser configuration, or subagent navigation behavior; the inspected excerpts show no concrete attack behavior.
Evidence against
- The hook’s agent configuration write is scoped to this package’s own ~/.pi/agent location; inspected source does not show credential collection, exfiltration, or a remote payload.
- The worktree test creates a temporary repository and removes it on exit; inspected code does not establish a malicious payload.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical10 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.20.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.