registry / @nklisch/pi-plugins / 0.1.4

@nklisch/pi-plugins@0.1.4

Native marketplace and plugin lifecycle management for Pi, with Claude Code and Codex compatibility.

Static Scan Results

scanned 10h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 403 file(s), 2.95 MB of source, external domains: example.com, github.com, registry.npmjs.org

Source & flagged code

1 flagged

dist/runtime/subagents/pi-subagents-package.jsView file

Lines 40-80javascript

40function probe(signal) {

41 verifiedPackage ??= probePublishedPackage({

42 entrySpecifier: "@nklisch/pi-subagents",

43 receipt: PI_SUBAGENTS_RECEIPT,

44 signal,

45 });

46 return verifiedPackage;

47}

48function rootModule(value) {

49 if (value === null || typeof value !== "object" ||

50 typeof value.getSubagentsService !== "function")

51 return undefined;

52 return value;

53}

54/** Load the exact package-declared Pi resource only after its full tree receipt passes. */

55export async function loadVerifiedPiSubagentsExtension(signal = new AbortController().signal) {

56 const result = await probe(signal);

57 if (result.kind !== "verified")

58 return undefined;

59 signal.throwIfAborted();

60 try {

61 const module = await loader().import(join(result.packageRoot, PI_SUBAGENTS_RECEIPT.piExtensions[0]));

62 const extension = module !== null && typeof module === "object"

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/subagents/pi-subagents-package.jsView on unpkg · L60

63 ? module.default

64 : undefined;

65 return typeof extension === "function"

66 ? extension

67 : undefined;

68 }

69 catch {

70 if (signal.aborted)

71 throw signal.reason;

72 return undefined;

73 }

74}

75/** Resolve the documented service root from the same verified package tree. */

76export async function loadVerifiedPiSubagentsService(signal = new AbortController().signal) {

77 const result = await probe(signal);

78 if (result.kind !== "verified")

79 return undefined;

80 signal.throwIfAborted();

Source & flagged code

1 flagged · loading source

dist/runtime/subagents/pi-subagents-package.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code