registry / @maxiaochao/pi-toolkit / 0.11.4

@maxiaochao/pi-toolkit@0.11.4

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The postinstall performs lifecycle-driven changes in the package’s own Pi agent environment, including replacing a differing global AGENTS.md file. The inspected content and other flagged source paths did not establish concrete malicious behavior, so this merits a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm, which runs its postinstall hook.

Impact

A user’s existing Pi agent instructions can be replaced during installation.

Mechanism

The hook copies the bundled AGENTS.md into ~/.pi/agent/AGENTS.md when the destination is absent or differs.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.mdpackages/worktree/scripts/install.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-agents.mjs automatically as a postinstall hook.
The hook targets ~/.pi/agent/AGENTS.md and replaces it when its contents differ from the bundled file.
The bundled agent file contains general coding guidance and says project-specific instructions override it.
The same hook installs the package’s pi-worktree command under the user’s local bin directory.

Evidence against

The inspected flagged network and process-execution findings are in browser tests or benchmark utilities, not evidence of an install-time attack.
The bundled agent instructions contain no observed credential collection or malicious control instructions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/worktree/tests/extension.test.mjsView file

57L58: const extension = (await import(`${extensionUrl}?test=${Math.random()}`)).default; L59: extension(pi);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/worktree/tests/extension.test.mjsView on unpkg · L57

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L11: const agentDir = join(homedir(), ".pi", "agent"); L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L13: const agentsTarget = join(agentDir, "AGENTS.md"); L14: const settingsTarget = join(agentDir, "settings.json"); ... L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L17: mkdirSync(dirname(agentsTarget), { recursive: true }); L18: writeFileSync(agentsTarget, bundled, "utf8"); L19: console.log("[pi-toolkit]

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4687 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.9.3 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High