Loading npm security reports…

@maxiaochao/pi-toolkit@0.2.6: AI-agent control-surface risk | LPM Firewall

registry / @maxiaochao/pi-toolkit / 0.2.6

@maxiaochao/pi-toolkit@0.2.6

Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. During npm installation, the package overwrites the global Pi agent instruction file whenever it differs from its bundled content. It also initializes global Pi agent settings without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Persists package-supplied behavior across the user's Pi agent environment and replaces existing global instructions.

Mechanism

Postinstall mutation of global Pi agent instructions and settings.

Policy narrative

Installing the package runs its postinstall hook automatically. That hook reads the package's bundled AGENTS.md and replaces the user's global ~/.pi/agent/AGENTS.md whenever the contents differ, then creates or changes ~/.pi/agent/settings.json. This is an unconsented mutation of a broad AI-agent control surface, not package-local setup. The inspected installer does not exfiltrate data or contact a network endpoint.

AI rationale

The automatic postinstall replaces global Pi agent instructions rather than setting up package-local artifacts, constituting unconsented broad AI-agent control-surface mutation. No credential exfiltration was found, but the lifecycle behavior meets the publish-block policy.

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md~/.pi/agent/AGENTS.md~/.pi/agent/settings.json

Decision evidence

public snapshot

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

45"scripts": { "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs && node --experimental-strip-types ../tests/btw-history.mjs && node tests/e2e-browser.mjs", "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts && pi -ne -e ./extensions/btw.ts", "eval:agents": "node evaluations/agents-md/run.mjs", "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs", "postinstall": "node scripts/install-agents.mjs"

High

Ai Review Evidence

The manifest automatically runs an installer after npm installation.

package.jsonView on unpkg · L45

scripts/install-agents.mjsView file

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme L2: // without overriding a theme the user has already selected. L3: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; L4: import { homedir } from "node:os"; ... L8: const agentDir = join(homedir(), ".pi", "agent"); L9: const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); L10: const agentsTarget = join(agentDir, "AGENTS.md"); L11: const settingsTarget = join(agentDir, "settings.json"); ... L13: if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { L14: mkdirSync(dirname(agentsTarget), { recursive: true }); L15: writeFileSync(agentsTarget, bundled, "utf8"); L16: console.log("[pi-toolkit] gl

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-agents.mjsView on unpkg · L1

8const agentDir = join(homedir(), ".pi", "agent"); const bundled = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "global", "AGENTS.md"), "utf8"); const agentsTarget = join(agentDir, "AGENTS.md"); const settingsTarget = join(agentDir, "settings.json"); if (!existsSync(agentsTarget) || readFileSync(agentsTarget, "utf8") !== bundled) { mkdirSync(dirname(agentsTarget), { recursive: true }); writeFileSync(agentsTarget, bundled, "utf8"); console.log("[pi-toolkit] global AGENTS.md synced ->", agentsTarget);

High

Ai Review Evidence

The installer overwrites the global Pi agent instruction file whenever it differs from the bundled content.

scripts/install-agents.mjsView on unpkg · L8