@maxiaochao/pi-toolkit@0.7.0
Personal pi coding agent toolkit: /todos, /btw, /cache_export extensions, browser automation, and bundled theme/skills.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall lifecycle automatically replaces a user's global Pi agent instructions when they differ from the bundled copy, without a consent guard. This is an unconsented install-time mutation of an AI-agent control surface, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package with its postinstall lifecycle enabled.
Impact
The install can replace the user's global agent instructions without an explicit setup action, altering future agent behavior.
Mechanism
The postinstall script reads the bundled AGENTS.md and writes it to ~/.pi/agent/AGENTS.md whenever the existing file is absent or differs.
Policy narrative
During package installation, the postinstall hook runs a script that unconditionally synchronizes the bundled global agent instructions into the user's Pi configuration. If the existing file differs, it is replaced without a consent prompt. This creates an install-time agent control surface mutation.
AI rationale
The postinstall lifecycle automatically replaces a user's global Pi agent instructions when they differ from the bundled copy, without a consent guard. This is an unconsented install-time mutation of an AI-agent control surface, so the package should be blocked.
Evidence
package.jsonscripts/install-agents.mjs~/.pi/agent/AGENTS.md~/.pi/agent/settings.json~/.local/bin/pi-worktree~/.local/share/bash-completion/completions/pi-worktree
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook automatically runs the agent setup script during package installation.
- The script targets the user's global Pi agent directory and replaces its AGENTS.md whenever its contents differ from the bundled file, without a consent check.
- The script also initializes missing settings and installs a CLI and shell completion in the user's home directory.
Evidence against
- The browser test uses child processes and network primitives as part of a real-browser end-to-end test.
- The browser automation scripts use configurable local debugging endpoints and browser process management; these findings do not establish package-install-time credential theft.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agents.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgextensions/cache-export/tests/e2e-browser.mjsView file
12L13: import { spawn, execFileSync } from "node:child_process";
L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
High
Child Process
Package source references child process execution.
extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L12•matchType = normalized_sha256
matchedPackage = @maxiaochao/pi-toolkit@0.5.2
matchedPath = extensions/cache-export/tests/e2e-browser.mjs
matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
1 Critical7 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-agents.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processextensions/cache-export/tests/e2e-browser.mjs
HighShellskills/web-browser/scripts/start.js
HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs
HighSemantic Analysis Limitedbin/pi-worktree
HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs
HighKnown Malware Source Similarityextensions/cache-export/tests/e2e-browser.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryskills/pdlog/tools/ppmd
Medium
Affected versions and remediation
This report applies to @maxiaochao/pi-toolkit@0.7.0.
See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.
- Avoid installing @maxiaochao/pi-toolkit@0.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.