registry / @preapexis/pi-kit / 2.3.1

@preapexis/pi-kit@2.3.1

Personal Pi coding-agent kit with safety extensions, status UI, prompt workflows, skills, and themes.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 47.1 KB of source

Source & flagged code

5 flagged

tests/helpers.test.tsView file

Lines 43-107typescript

43});

45describe("isInsideProject", () => {

46 it("returns true for paths inside the cwd", () => {

47 assert.equal(isInsideProject("src/index.ts", "/home/user/project"), true);

48 assert.equal(isInsideProject("/home/user/project/src/index.ts", "/home/user/project"), true);

49 });

51 it("returns false for paths outside the cwd", () => {

52 assert.equal(isInsideProject("/etc/passwd", "/home/user/project"), false);

53 assert.equal(isInsideProject("../secrets.txt", "/home/user/project"), false);

54 });

56 it("returns true for the cwd itself", () => {

57 assert.equal(isInsideProject("/home/user/project", "/home/user/project"), true);

58 });

59});

61describe("scanForSecrets", () => {

62 it("detects an AWS access key", () => {

63 assert.deepEqual(scanForSecrets("AKIAIOSFODNN7EXAMPLE"), ["AWS access key"]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/helpers.test.tsView on unpkg · L63

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L63

64 });

66 it("detects an OpenAI-style secret key", () => {

67 assert.deepEqual(scanForSecrets("sk-abcdefghijklmnopqrstuvwxyz1234"), [

68 "OpenAI/Anthropic-style secret key",

69 ]);

70 });

72 it("detects assigned password values", () => {

73 assert.deepEqual(scanForSecrets("DB_PASSWORD = 'supersecret12345'"), [

74 "assigned secret/token/password/key value",

75 ]);

76 });

78 it("detects private key blocks", () => {

79 assert.deepEqual(scanForSecrets("-----BEGIN OPENSSH PRIVATE KEY-----"), ["private key block"]);

Critical

Secret Pattern

OpenSSH private key in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L79

80 });

82 it("returns an empty array for clean content", () => {

83 assert.deepEqual(scanForSecrets("hello world"), []);

84 });

86 it("reports every matched pattern type", () => {

87 const content = "AKIAIOSFODNN7EXAMPLE and sk-abcdefghijklmnopqrstuvwxyz1234";

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L87

88 const found = scanForSecrets(content);

89 assert.equal(found.includes("AWS access key"), true);

90 assert.equal(found.includes("OpenAI/Anthropic-style secret key"), true);

91 });

92});

94describe("isMemoryFileTarget", () => {

95 it("returns true for memory file names", () => {

96 assert.equal(isMemoryFileTarget("AGENTS.md"), true);

97 assert.equal(isMemoryFileTarget("/project/GEMINI.md"), true);

98 assert.equal(isMemoryFileTarget("CLAUDE.md"), true);

99 });

100

101 it("returns false for non-memory files", () => {

102 assert.equal(isMemoryFileTarget("README.md"), false);

103 assert.equal(isMemoryFileTarget("package.json"), false);

104 });

105

106 it("returns false for undefined", () => {

107 assert.equal(isMemoryFileTarget(undefined), false);

skills/caveman-compress/scripts/benchmark.pyView file

•path = skills/caveman-compress/scripts/benchmark.py kind = build_helper sizeBytes = 2425 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/caveman-compress/scripts/benchmark.pyView on unpkg

Source & flagged code

5 flagged · loading source

tests/helpers.test.tsView file

63patternName = aws_access_key severity = critical line = 63 matchedText = assert.d..."]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/helpers.test.tsView on unpkg · L63

63patternName = aws_access_key severity = critical line = 63 matchedText = assert.d..."]);

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L63

79patternName = private_key_openssh severity = critical line = 79 matchedText = assert.d..."]);

Critical

Secret Pattern

OpenSSH private key in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L79

87patternName = aws_access_key severity = critical line = 87 matchedText = const co...34";

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L87

skills/caveman-compress/scripts/benchmark.pyView file

•path = skills/caveman-compress/scripts/benchmark.py kind = build_helper sizeBytes = 2425 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/caveman-compress/scripts/benchmark.pyView on unpkg

Findings

4 Critical3 Medium3 Low

CriticalCritical Secrettests/helpers.test.ts

CriticalSecret Patterntests/helpers.test.ts

MediumEnvironment Vars

MediumShips Build Helperskills/caveman-compress/scripts/benchmark.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

tests/helpers.test.tsView file

Lines 43-107typescript

43});

45describe("isInsideProject", () => {

46 it("returns true for paths inside the cwd", () => {

47 assert.equal(isInsideProject("src/index.ts", "/home/user/project"), true);

48 assert.equal(isInsideProject("/home/user/project/src/index.ts", "/home/user/project"), true);

49 });

51 it("returns false for paths outside the cwd", () => {

52 assert.equal(isInsideProject("/etc/passwd", "/home/user/project"), false);

53 assert.equal(isInsideProject("../secrets.txt", "/home/user/project"), false);

54 });

56 it("returns true for the cwd itself", () => {

57 assert.equal(isInsideProject("/home/user/project", "/home/user/project"), true);

58 });

59});

61describe("scanForSecrets", () => {

62 it("detects an AWS access key", () => {

63 assert.deepEqual(scanForSecrets("AKIAIOSFODNN7EXAMPLE"), ["AWS access key"]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

tests/helpers.test.tsView on unpkg · L63

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L63

64 });

66 it("detects an OpenAI-style secret key", () => {

67 assert.deepEqual(scanForSecrets("sk-abcdefghijklmnopqrstuvwxyz1234"), [

68 "OpenAI/Anthropic-style secret key",

69 ]);

70 });

72 it("detects assigned password values", () => {

73 assert.deepEqual(scanForSecrets("DB_PASSWORD = 'supersecret12345'"), [

74 "assigned secret/token/password/key value",

75 ]);

76 });

78 it("detects private key blocks", () => {

79 assert.deepEqual(scanForSecrets("-----BEGIN OPENSSH PRIVATE KEY-----"), ["private key block"]);

Critical

Secret Pattern

OpenSSH private key in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L79

80 });

82 it("returns an empty array for clean content", () => {

83 assert.deepEqual(scanForSecrets("hello world"), []);

84 });

86 it("reports every matched pattern type", () => {

87 const content = "AKIAIOSFODNN7EXAMPLE and sk-abcdefghijklmnopqrstuvwxyz1234";

Critical

Secret Pattern

AWS access key ID in tests/helpers.test.ts

tests/helpers.test.tsView on unpkg · L87

88 const found = scanForSecrets(content);

89 assert.equal(found.includes("AWS access key"), true);

90 assert.equal(found.includes("OpenAI/Anthropic-style secret key"), true);

91 });

92});

94describe("isMemoryFileTarget", () => {

95 it("returns true for memory file names", () => {

96 assert.equal(isMemoryFileTarget("AGENTS.md"), true);

97 assert.equal(isMemoryFileTarget("/project/GEMINI.md"), true);

98 assert.equal(isMemoryFileTarget("CLAUDE.md"), true);

99 });

100

101 it("returns false for non-memory files", () => {

102 assert.equal(isMemoryFileTarget("README.md"), false);

103 assert.equal(isMemoryFileTarget("package.json"), false);

104 });

105

106 it("returns false for undefined", () => {

107 assert.equal(isMemoryFileTarget(undefined), false);

skills/caveman-compress/scripts/benchmark.pyView file

•path = skills/caveman-compress/scripts/benchmark.py kind = build_helper sizeBytes = 2425 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/caveman-compress/scripts/benchmark.pyView on unpkg