registry / @rpollard00/pi-materia / 0.1.10

@rpollard00/pi-materia@0.1.10

A Pi extension for configurable, materia-themed agent pipelines.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Loading package configuration creates or updates package-owned Pi utility scripts. Selected pipeline utilities can execute local VCS commands and configured PR API requests with inherited environment credentials.

Static reason

No blocking static signals were detected.

Trigger

Pi extension configuration load; later, user/agent selection of configured utility sockets.

Impact

Persists package utilities in its own profile area; explicit utilities can modify the current repository or create PRs.

Mechanism

first-party extension utility provisioning and configured command execution

Rationale

No concrete malicious chain was found. The automatic package-owned utility provisioning is a guarded extension lifecycle risk under the firewall policy, so it warrants a warning rather than a block.

Evidence

package.jsonsrc/config/config.tssrc/config/shippedUtilities.tssrc/infrastructure/utilityCommandExecutor.tssrc/runtime/webhookSink.tsconfig/utilities/mime-gh-pr.mjsconfig/utilities/blackbelt-gh-pr.mjsconfig/utilities/mime-ado-pr.mjsconfig/utilities/blackbelt-ado-pr.mjs

Network endpoints2

api.github.comdev.azure.com

@rpollard00/pi-materia@0.1.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code