registry / @maxiaochao/pi-toolkit / 0.11.8

@maxiaochao/pi-toolkit@0.11.8

Personal pi coding agent toolkit: scheduler, /btw, /cache_export, apply_patch, browser automation, and bundled theme/skills.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The postinstall hook automatically replaces a differing global Pi AGENTS.md with package-owned guidance. This first-party agent configuration setup warrants a warning, but the inspected source does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

This changes global Pi agent guidance without a consent check; the inspected bundled content is ordinary coding advice.

Mechanism

The hook reads global/AGENTS.md and writes it to ~/.pi/agent/AGENTS.md when the target is missing or differs.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/install-agents.mjs during postinstall.
The installer reads the bundled AGENTS.md and targets ~/.pi/agent/AGENTS.md.
When that file differs from the bundle, the installer replaces it without a consent check.
The bundled file contains coding guidance and says project instructions override it.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 118 file(s), 1.03 MB of source, external domains: 127.0.0.1, api.openai.com, auth.openai.com, chatgpt.com, example.com, example.invalid, github.com, login.invalid

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/openai-account-pool/tests/failover-stream.mjsView file

9L10: const { [redacted], lazyStream } = await import(piAiEntry()); L11:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/openai-account-pool/tests/failover-stream.mjsView on unpkg · L9

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L11: const agentDir = join(homedir(), ".pi", "agent"); L12: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L13: const agentsTarget = join(agentDir, "AGENTS.md"); L14: const settingsTarget = join(agentDir, "settings.json"); ... L16: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L17: mkdirSync(dirname(agentsTarget), { recursive: true }); L18: writeFileSync(agentsTarget, bundled, "utf8"); L19: console.log("[pi-toolkit]

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

packages/worktree/bin/pi-worktree-completion.bashView file

•path = packages/worktree/bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/worktree/bin/pi-worktree-completion.bashView on unpkg

packages/worktree/tests/run-tests.shView file

•path = packages/worktree/tests/run-tests.sh kind = payload_in_excluded_dir sizeBytes = 4687 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

packages/worktree/tests/run-tests.shView on unpkg

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/codex-edit/tests/generate-test-report.mjs#virtual:string-array:round1View on unpkg

skills/web-browser/scripts/start.jsView file

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.11.5 matchedPath = skills/web-browser/scripts/start.js matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.11.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High