registry / @maxiaochao/pi-toolkit / 0.6.1

@maxiaochao/pi-toolkit@0.6.1

Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source confirms an automatic postinstall that writes package-owned configuration into the pi-agent global directory and installs a user-level CLI. The inspected behavior is scoped to this package's pi-agent setup, so it warrants a warning but does not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

The installation can change global pi-agent instructions and settings and add a user-level command.

Mechanism

The hook syncs the bundled AGENTS.md into ~/.pi/agent, fills in a missing default theme setting, and copies the package's CLI and completion files into user-level directories.

AI rationale

Evidence

package.jsonscripts/install-agents.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/install-agents.mjs from its postinstall hook.
That script writes the bundled AGENTS.md to the user's global ~/.pi/agent/AGENTS.md during installation, without a consent check.
The same hook sets a default theme and installs the package's pi-worktree command and completion files under the user's home directory.

Evidence against

The global agent file and settings write is limited to the package's own pi-agent location; inspected source showed no network endpoint or credential forwarding in this setup path.
The browser automation and worktree command findings are test or explicit-command behavior, not evidence of an install-time attack.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

10 flagged

package.jsonView file

Lines 34-60json

34 "./themes"

35 ]

36 },

37 "bin": {

38 "pi-worktree": "bin/pi-worktree"

39 },

40 "peerDependencies": {

41 "@earendil-works/pi-ai": "*",

42 "@earendil-works/pi-coding-agent": "*",

43 "@earendil-works/pi-tui": "*",

44 "typebox": "*"

45 },

46 "dependencies": {

47 "ws": "^8.19.0"

48 },

49 "scripts": {

50 "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs && node --experimental-strip-types ../tests/btw-history.mjs && node tests/e2e-browser.mjs",

51 "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts && pi -ne -e ./extensions/btw.ts",

52 "eval:agents": "node evaluations/agents-md/run.mjs",

53 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

54 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

55 },

56 "publishConfig": {

57 "access": "public"

58 }

59}

extensions/cache-export/tests/e2e-browser.mjsView file

Lines 1-32javascript

1// Real-browser end-to-end test for the cache dashboard.

2// Drives actual pointer events in headless Chromium via raw CDP (Node 22

3// built-ins only: fetch + WebSocket) and asserts the hover tooltip keeps

4// working across polyline break boundaries and inside segment views.

5//

6// Chrome discovery mirrors the web-browser skill (BROWSER_BIN, common Linux

7// paths, Playwright cache, WSL Windows Chrome). If no browser is found the

8// test prints SKIP and exits 0 so CI without Chrome still passes; if a

9// browser IS found, failing assertions exit 1.

skills/web-browser/scripts/start.jsView file

Lines 41-81javascript

42const HOME = process.env["HOME"] || homedir();

43const CACHE_ROOT = join(HOME, ".cache", "agent-web"

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs";

4import { homedir, platform } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

12L13: import { spawn, execFileSync } from "node:child_process"; L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.5.2 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

1 Critical7 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-agents.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processextensions/cache-export/tests/e2e-browser.mjs

HighShellskills/web-browser/scripts/start.js

HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs

HighSemantic Analysis Limitedbin/pi-worktree

HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs

HighKnown Malware Source Similarityextensions/cache-export/tests/e2e-browser.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryskills/pdlog/tools/ppmd

Medium

Affected versions and remediation

This report applies to @maxiaochao/pi-toolkit@0.6.1.

See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.

Review the evidence and your use of @maxiaochao/pi-toolkit@0.6.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:09:59.630Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.