registry / @maxiaochao/pi-toolkit / 0.6.0

@maxiaochao/pi-toolkit@0.6.0

Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The postinstall hook performs automatic writes to user-wide Pi agent configuration, including replacing an existing AGENTS.md. This supports a warning for agent configuration lifecycle risk, but the inspected behavior does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

The user's global Pi agent instructions may be changed during package installation.

Mechanism

The hook reads the bundled AGENTS.md and writes it to ~/.pi/agent/AGENTS.md whenever the target is absent or differs, without a consent check in the inspected code.

AI rationale

Evidence

package.jsonscripts/install-agents.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/install-agents.mjs during postinstall.
The installer targets the user-wide ~/.pi/agent/AGENTS.md file and replaces it when its contents differ from the bundled file.
The installer also initializes the Pi agent theme setting when missing and installs the package's pi-worktree command on Unix-like systems.

Evidence against

The inspected installer behavior is limited to the Pi agent configuration, a default theme, and this package's own CLI; the reviewed excerpts show no credential collection or network transfer.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 24 file(s), 233 KB of source, external domains: 127.0.0.1, example.com

Source & flagged code

9 flagged

package.jsonView file

Lines 34-60json

34 "./themes"

35 ]

36 },

37 "bin": {

38 "pi-worktree": "bin/pi-worktree"

39 },

40 "peerDependencies": {

41 "@earendil-works/pi-ai": "*",

42 "@earendil-works/pi-coding-agent": "*",

43 "@earendil-works/pi-tui": "*",

44 "typebox": "*"

45 },

46 "dependencies": {

47 "ws": "^8.19.0"

48 },

49 "scripts": {

50 "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs && node --experimental-strip-types ../tests/btw-history.mjs && node tests/e2e-browser.mjs",

51 "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts && pi -ne -e ./extensions/btw.ts",

52 "eval:agents": "node evaluations/agents-md/run.mjs",

53 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

54 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 },

56 "publishConfig": {

57 "access": "public"

58 }

59}

extensions/cache-export/tests/e2e-browser.mjsView file

Lines 1-32javascript

1// Real-browser end-to-end test for the cache dashboard.

2// Drives actual pointer events in headless Chromium via raw CDP (Node 22

3// built-ins only: fetch + WebSocket) and asserts the hover tooltip keeps

4// working across polyline break boundaries and inside segment views.

5//

6// Chrome discovery mirrors the web-browser skill (BROWSER_BIN, common Linux

7// paths, Playwright cache, WSL Windows Chrome). If no browser is found the

8// test prints SKIP and exits 0 so CI without Chrome still passes; if a

9// browser IS found, failing assertions exit 1.

skills/web-browser/scripts/start.jsView file

Lines 41-81javascript

42const HOME = process.env["HOME"] || homedir();

43const CACHE_ROOT = join(HOME, ".cache", "agent-web"

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs";

4import { homedir, platform } from "node:os";

5import { dirname, join } from "node:path";

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

12L13: import { spawn, execFileSync } from "node:child_process"; L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.5.2 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

1 Critical7 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-agents.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processextensions/cache-export/tests/e2e-browser.mjs

HighShellskills/web-browser/scripts/start.js

HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs

HighSemantic Analysis Limitedbin/pi-worktree

HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs

HighKnown Malware Source Similarityextensions/cache-export/tests/e2e-browser.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/pi-worktree-completion.bash

Medium

Affected versions and remediation

This report applies to @maxiaochao/pi-toolkit@0.6.0.

See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.

Review the evidence and your use of @maxiaochao/pi-toolkit@0.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:10:00.912Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.