registry / @plannotator/pi-extension / 0.22.0

@plannotator/pi-extension@0.22.0

Plannotator Pi extension - interactive plan review with annotations, annotate agent messages, and review code/PRs

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The extension provides user-invoked local plan/review servers and optional URL annotation; its outbound request is tied to the supplied URL.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User loads the Pi extension and explicitly invokes plan, review, annotation, or agent-review UI actions.

Impact

Expected extension functionality; no unconsented install-time mutation or exfiltration found.

Mechanism

Local review UI, controlled CLI launches, and optional URL-to-Markdown conversion.

Rationale

Direct inspection found no install-time execution or concrete malicious chain. Network, filesystem, and child-process features are aligned with the extension's interactive review functions and are user-triggered.

Evidence

package.jsonindex.tsserver/network.tsserver/agent-jobs.tsserver/serverReview.tsgenerated/url-to-markdown.ts

Network endpoints1

r.jina.ai/

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with false-positive risk.

@plannotator/pi-extension@0.22.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code