registry / AI-agent control-surface risk / @rosetears/aili-pi
@rosetears/aili-pi
AILI and ROSE distribution for official Pi
This report shows the evidence for @rosetears/aili-pi@0.1.9. 1 of 5 known versions is blocked or flagged. The newest version, 0.2.9, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. No separate exfiltration chain is needed for the blocking verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall when installed under either recognized Pi npm root
Impact
Existing agent instructions/capabilities can be replaced without user approval.
Mechanism
stages and replaces matching global AI-agent skills
Policy narrative
The automatic postinstall invokes sync-global-skills.mjs. When the package resides in a Pi-managed npm directory, it enumerates packaged skills and replaces every existing same-name real directory in ~/.agents/skills via staged copy, rename, and deletion. This mutates a broad global AI-agent control surface without an explicit user command; checking the package install location does not prove those global targets belong to this package.
AI rationale
This is a concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. No separate exfiltration chain is needed for the blocking verdict.
Evidence
package.jsonscripts/sync-global-skills.mjsREADME.mdskills/~/.agents/skills/<matching-skill>
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- scripts/sync-global-skills.mjs targets ~/.agents/skills.
- It replaces pre-existing same-name skill directories using rename/rm.
- The Pi-managed-path check does not establish ownership of ~/.agents/skills targets.
Evidence against
- Lifecycle script contains no network or credential collection.
- Global ~/.pi resource writes require an explicit Pi command.
- Zentui child-process use is bounded version probing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/sync-global-skills.mjs --if-pi-managed
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/sync-global-skills.mjs --if-pi-managed
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgextensions/zentui/runtime.tsView file
1import { execFile } from "node:child_process";
L2: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
extensions/zentui/runtime.tsView on unpkg · L1Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/vendor/pi-permission-modes/index.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processextensions/zentui/runtime.ts
HighShellskills/minimax-pdf/scripts/render_cover.js
HighRuntime Package Installskills/minimax-pdf/scripts/render_cover.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireskills/minimax-pdf/scripts/render_cover.js
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @rosetears/aili-pi@0.1.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing @rosetears/aili-pi@0.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.