registry / @maxiaochao/pi-toolkit / 0.11.0

@maxiaochao/pi-toolkit@0.11.0

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic postinstall performs first-party pi configuration and CLI setup, creating an agent lifecycle risk that merits a warning. The inspected sources do not establish concrete malicious behavior or a foreign control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm runs the package’s postinstall hook.

Impact

These changes add package-owned agent instructions and a user-level command without a separate setup command.

Mechanism

The hook syncs the bundled AGENTS.md, initializes a missing theme setting, and invokes the worktree installer to copy its executable and completion file.

AI rationale

Evidence

package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-agents.mjs automatically through postinstall.
The postinstall script writes the bundled AGENTS.md into ~/.pi/agent when it is missing or differs, and seeds a default theme only when needed.
The hook also installs a pi-worktree executable and shell completion files under the user’s home directory.
The flagged worktree script is a temporary-repository test; the report generator runs declared checks and captures their output.
The browser launcher uses a user-selected local browser and a cache directory; its flagged end-to-end browser test discovers Chrome for testing.
The benchmark scripts run a caller-supplied command or require an explicit source path and verify its commit.

Evidence against

The inspected install path contains no network request or remote payload retrieval.
The agent configuration and CLI changes are limited to this toolkit’s own pi configuration and command; the inspected code does not show a write to another agent’s control surface.

Behavioral surface

Source

ChildProcess

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/worktree/tests/extension.test.mjsView file

57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default; L59: extension(pi);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/worktree/tests/extension.test.mjsView on unpkg · L57

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

6import { fileURLToPath } from "node:url";

7import { installWorktree } from "../packages/worktree/scripts/install.mjs";

9const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");

11const agentDir = join(homedir(), ".pi", "agent");

12const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");

13const agentsTarget = join(agentDir, "AGENTS.md");

14const settingsTarget = join(agentDir, "settings.json");

16if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {

17 mkdirSync(dirname(agentsTarget), { recursive: true });

18 writeFileSync(agentsTarget, bundled, "utf8");

19 console.log("[pi-toolkit] global AGENTS.md synced ->", agentsTarget);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

20}

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4687 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.9.3 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High