registry / @maxiaochao/pi-toolkit / 0.2.3
@maxiaochao/pi-toolkit@0.2.3
Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically writes package-owned instructions into global Pi agent configuration, creating a guarded agent lifecycle risk. The inspected code does not establish malicious control hijacking or credential exposure.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The package’s npm postinstall hook runs during installation.
Impact
A differing global Pi agent instructions file can be overwritten during installation. The inspected behavior is limited to this package’s own Pi configuration.
Mechanism
The installer writes bundled AGENTS.md instructions to ~/.pi/agent/AGENTS.md and sets a default theme only when one is absent.
AI rationale
The postinstall hook automatically writes package-owned instructions into global Pi agent configuration, creating a guarded agent lifecycle risk. The inspected code does not establish malicious control hijacking or credential exposure.
Evidence
package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md~/.pi/agent/settings.json
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook automatically runs the agent installer.
- The installer writes the package’s bundled instructions to the user’s global Pi agent instructions file when it is missing or differs.
- The bundled file contains general coding guidance; the installer also sets the default theme only when no theme is configured.
Evidence against
- The installer targets the package’s own Pi agent configuration and theme, and the bundled instructions appear consistent with that purpose.
- The browser launcher uses an isolated profile by default; copying the Chrome profile requires the explicit --profile option.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg50"postinstall": "node scripts/install-agents.mjs"
},
Medium
Suspicious Lifecycle Evidence
The npm postinstall hook automatically runs the agent installer.
package.jsonView on unpkg · L50scripts/install-agents.mjsView file
1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme
L2: // without overriding a theme the user has already selected.
L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L8: const agentDir = join(homedir(), ".pi", "agent");
L9: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8");
L10: const agentsTarget = join(agentDir, "AGENTS.md");
L11: const settingsTarget = join(agentDir, "settings.json");
...
L13: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) {
L14: mkdirSync(dirname(agentsTarget), { recursive: true });
L15: writeFileSync(agentsTarget, bundled, "utf8");
L16: console.log("[pi-toolkit] gl
Findings
1 Critical1 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencescripts/install-agents.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.2.3.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Review the evidence and your use of @maxiaochao/pi-toolkit@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.