registry / @maxiaochao/pi-toolkit / 0.10.22
@maxiaochao/pi-toolkit@0.10.22
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook performs automatic, package-aligned pi agent setup by syncing global instructions, initializing a theme, and installing the toolkit's own command. This warrants a warning for agent extension lifecycle risk, but the inspected source does not establish malicious behavior or a publish-blocking attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package with lifecycle scripts enabled.
Impact
The installation changes the user's pi agent configuration and adds the pi-worktree command and shell completion.
Mechanism
The hook syncs bundled instructions to the global pi agent directory, fills in a missing theme, and invokes the package's worktree installer.
AI rationale
The postinstall hook performs automatic, package-aligned pi agent setup by syncing global instructions, initializing a theme, and installing the toolkit's own command. This warrants a warning for agent extension lifecycle risk, but the inspected source does not establish malicious behavior or a publish-blocking attack.
Evidence
package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/install-agents.mjs automatically after installation.
- The hook writes bundled instructions to the global pi agent directory when its existing file differs.
- The hook initializes the agent theme and installs this package's pi-worktree command.
- The worktree test uses a temporary repository and removes it on exit.
- The report generator defines explicit checks, the browser test exercises dashboard interactions, and the browser launcher gates profile copying behind a command-line option.
- The benchmark utilities validate a supplied source revision and run a caller-provided command; the subagent file defines request interfaces.
Evidence against
- The inspected sources show package-aligned pi setup and testing behavior; they do not establish credential collection, exfiltration, or a remote payload chain.
- The postinstall settings change fills in a missing theme and preserves an existing nonempty theme value.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical9 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.10.22.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.10.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.