registry / @maxiaochao/pi-toolkit / 0.10.21
@maxiaochao/pi-toolkit@0.10.21
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection confirms an automatic postinstall that sets up this toolkit's own Pi guidance, theme, and CLI, while the flagged browser, report, and benchmark code is tooling or test code. The inspected behavior does not establish a concrete malicious attack, so the package is clean under the stated decision policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The changes run during npm postinstall.
Impact
This performs global Pi configuration and CLI setup; the inspected behavior does not show a foreign agent control-surface write or credential exposure.
Mechanism
The installer copies this package's agent guidance into the user's Pi agent directory, seeds a default theme when missing, and installs the package's worktree command and completion files.
AI rationale
Source inspection confirms an automatic postinstall that sets up this toolkit's own Pi guidance, theme, and CLI, while the flagged browser, report, and benchmark code is tooling or test code. The inspected behavior does not establish a concrete malicious attack, so the package is clean under the stated decision policy.
Evidence
~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook invokes the agent installer automatically.
- The installer writes bundled guidance into the global Pi agent directory, seeds a default theme, and installs a worktree CLI and completion files.
- The flagged browser and cache files launch a locally discovered browser and bind the test server to loopback.
- The remaining flagged files are test-report and benchmark utilities; their process execution is tied to explicit tool use.
- The Herdr source exposes child-process based agent orchestration interfaces.
Evidence against
- The global agent guidance is synchronized only when absent or different, and settings are parsed and updated only to seed a missing theme.
- The worktree test creates a temporary mock Pi executable and a temporary Git repository.
- Task selection requires an explicit source path and validates the source commit before reading benchmark tasks.
- Inspected indicators do not establish credential harvesting, unrelated network exfiltration, or a malicious package lifecycle chain.
Behavioral surface
ChildProcess
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical9 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.21.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.