registry / @surgee/pi-flow / 0.3.0

@surgee/pi-flow@0.3.0

Pi extension for checked plans, live reports, completion acceptance, and quality checks.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is a user-invoked Pi workflow extension that manages project flow artifacts and an authenticated local report service.

Static reason

No blocking static signals were detected.

Trigger

Loading the Pi extension, then invoking /flow or related Pi session commands.

Impact

Creates workflow/report state and may start a loopback report server; no evidence of exfiltration or unconsented install-time mutation.

Mechanism

Pi command registration, local report daemon, and project-local workflow state.

Rationale

Static source inspection shows a package-aligned Pi extension with explicit command/session activation and a capability-protected local report service. No concrete malicious behavior or install-time control-surface mutation was found.

Evidence

package.jsondist/index.jsdist/bootstrap.jsdist/shared/config.jsdist/shared/report-client.jsdist/report-daemon.jsdist/flow/prewalk.jsdist/flow/parallel/spawner.js.flow/~/.pi/agent/pi-flow-report/

Network endpoints1

127.0.0.1:49327

@surgee/pi-flow@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Findings