registry / @maxiaochao/pi-toolkit / 0.11.20

@maxiaochao/pi-toolkit@0.11.20

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The automatic postinstall overwrite of global Pi agent instructions is a guarded first-party package setup risk, so it warrants a warning. The inspected bundled guidance and related theme and CLI setup do not establish a malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

An existing global agent instruction file can be overwritten without a separate consent check. The inspected bundled content is general coding guidance; no more severe behavior was established.

Mechanism

The hook writes the bundled AGENTS.md to ~/.pi/agent/AGENTS.md whenever the target is absent or differs.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/install-agents.mjs during postinstall.
The hook replaces ~/.pi/agent/AGENTS.md when its contents differ from the bundled file.
The bundled file contains general coding guidance; the settings write initializes a default theme, and the worktree installer copies this package’s own CLI.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 92 file(s), 817 KB of source, external domains: 127.0.0.1, example.com, github.com

Source & flagged code

15 flagged

package.jsonView file

Lines 48-74json

48 },

49 "bin": {

50 "pi-worktree": "packages/worktree/bin/pi-worktree"

51 },

52 "peerDependencies": {

53 "@earendil-works/pi-ai": "*",

54 "@earendil-works/pi-coding-agent": "*",

55 "@earendil-works/pi-tui": "*",

56 "typebox": "*"

57 },

58 "dependencies": {

59 "ws": "^8.19.0"

60 },

61 "scripts": {

62 "test": "node tests/package-layout.mjs && node tests/release-check.mjs && npm --prefix packages/todo test && npm --prefix packages/cache-export test && npm --prefix packages/codex-edit test && npm --prefix packages/herdr-subagents test && npm --prefix packages/openai-account-pool test && npm --prefix packages/scheduler test && npm --prefix packages/worktree test && node --experimental-strip-types extensions/btw/tests/history.mjs",

63 "test:root": "node tests/package-layout.mjs && node tests/release-check.mjs && node --experimental-strip-types extensions/btw/tests/history.mjs",

64 "load-test": "pi -ne -e ./packages/cache-export/extensions/cache-export.ts && pi -ne -e ./extensions/btw/index.ts && pi -ne -e ./packages/codex-edit/extensions/codex-edit.ts && pi -ne -e ./packages/herdr-subagents/extensions/herdr-subagents.ts && pi -ne -e ./packages/scheduler/extensions/scheduler.ts && pi -ne -e ./packages/worktree/extensions/worktree.ts",

65 "load-test:root": "pi -ne -e ./extensions/btw/index.ts",

66 "eval:agents": "node evaluations/agents-md/run.mjs",

67 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

68 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L68

69 },

70 "publishConfig": {

71 "access": "public"

72 }

73}

packages/worktree/tests/extension.test.mjsView file

Lines 37-77javascript

37 let releaseExec;

38 let markExecStarted;

39 const execStarted = new Promise(resolve => { markExecStarted = resolve; });

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4687 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.17 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High