registry / @maxiaochao/pi-toolkit / 0.11.1
@maxiaochao/pi-toolkit@0.11.1
Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically updates Pi agent instructions and seeds configuration, creating a real agent configuration lifecycle risk. The inspected behavior is scoped to this toolkit's Pi setup and does not establish a concrete malicious attack, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package with npm runs its postinstall hook.
Impact
An existing Pi agent instruction file may be replaced during installation; the hook also makes package-owned configuration and CLI changes.
Mechanism
The hook writes the bundled instructions to the user's Pi agent directory when the existing file is absent or differs, and seeds a missing theme setting. It also installs this package's worktree CLI and shell completion files in local user directories.
AI rationale
The postinstall hook automatically updates Pi agent instructions and seeds configuration, creating a real agent configuration lifecycle risk. The inspected behavior is scoped to this toolkit's Pi setup and does not establish a concrete malicious attack, so a warning is appropriate.
Evidence
package.jsonscripts/install-agents.mjspackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install-agents.mjs during postinstall.
- The postinstall targets the Pi agent directory and replaces AGENTS.md when its contents differ from the bundled copy.
- The hook seeds a missing theme setting and fills in a missing theme value; the worktree installer copies this package's CLI and completion file into the user's local bin and completion directories.
- The flagged test and benchmark files contain test setup, report generation, budgeted command execution, or task selection; the browser script reads explicit browser settings.
Evidence against
- The inspected behavior sets up this toolkit's own Pi configuration and CLI; no credential collection, exfiltration, or remote payload execution was identified.
- The unrelated scanner-flagged test and benchmark files show no concrete attack behavior in the inspected excerpts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/worktree/tests/extension.test.mjsView file
57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default;
L59: extension(pi);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/worktree/tests/extension.test.mjsView on unpkg · L57scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L11: const agentDir = join(homedir(), ".pi", "agent");
L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L13: const agentsTarget = join(agentDir, "AGENTS.md");
L14: const settingsTarget = join(agentDir, "settings.json");
...
L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L17: mkdirSync(dirname(agentsTarget), { recursive: true });
L18: writeFileSync(agentsTarget, bundled, "utf8");
L19: console.log("[pi-toolkit]
Findings
1 Critical8 High6 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirpackages/worktree/tests/run-tests.sh
HighSemantic Analysis Limitedpackages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1
HighKnown Malware Source Similarityskills/web-browser/scripts/start.js
HighKnown Malware Source Similaritypackages/cache-export/tests/e2e-browser.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/run-with-budget.mjs
HighKnown Malware Source Similaritypackages/codex-edit/benchmark/select-tasks.mjs
HighKnown Malware Source Similaritypackages/codex-edit/tests/generate-test-report.mjs
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.11.1.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.