@tekmidian/pai@0.35.0

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Inspected source does not support the scanner's malicious label: flagged hook excerpts show environment/configuration reads, while the CLI guards its agent-settings mutation with a user prompt. The package manifest shows no install-time lifecycle trigger, and the required flagged source locations do not establish an attack surface.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the setup command and confirms the settings patch.

Impact

The inspected behavior adds user-requested PAI configuration; no unconsented attack effect was established.

Mechanism

The CLI asks before merging PAI hooks and environment values into Claude settings, and returns without patching if the user declines.

AI rationale

Evidence

~/.claude/settings.json

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares package entrypoints and no install lifecycle hook; its only lifecycle-named script is prepublishOnly.
The flagged hook excerpts load environment configuration and project notes; they do not show writes to agent settings.
The CLI asks before patching Claude settings and skips the patch when declined.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 1.74 MB of source, external domains: api.todoist.com, app.todoist.com, github.com, json-schema.org, ntfy.sh, www.apple.com

Source & flagged code

11 flagged

dist/checkpoint-block-D3rm4dAJ.mjsView file

635} L636: const { spawn } = await import("node:child_process"); L637: return new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/checkpoint-block-D3rm4dAJ.mjsView on unpkg · L635

dist/pick-D7-XuJqF.mjsView file

3745], L3746: shell: true L3747: });

High

Shell

Package source references shell execution.

dist/pick-D7-XuJqF.mjsView on unpkg · L3745

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/pick-D7-XuJqF.mjsView on unpkg

21Cross-file remote execution chain: dist/pick-D7-XuJqF.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution. L21: import { fileURLToPath } from "node:url"; L22: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L23: import { createInterface } from "node:readline"; L24: import { createConnection } from "net"; L25: import { promisify } from "node:util"; ... L37: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L38: * /private/tmp/ops-webui dead L39: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L268: function findProjectNotesDirs(project) { L269: const claudeProjects = join(homedir(), ".claude", "projects");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pick-D7-XuJqF.mjsView on unpkg · L21

21Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs -> dist/pick-D7-XuJqF.mjs L21: import { fileURLToPath } from "node:url"; L22: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L23: import { createInterface } from "node:readline"; L24: import { createConnection } from "net"; L25: import { promisify } from "node:util"; ... L37: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L38: * /private/tmp/ops-webui dead L39: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L268: function findProjectNotesDirs(project) { L269: const claudeProjects = join(homedir(), ".claude", "projects"); L270: if (!existsSync(claudeProjects)) return []; ...

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/pick-D7-XuJqF.mjsView on unpkg · L21

21import { fileURLToPath } from "node:url"; L22: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L23: import { createInterface } from "node:readline"; L24: import { createConnection } from "net"; L25: import { promisify } from "node:util"; ... L37: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L38: * /private/tmp/ops-webui dead L39: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L268: function findProjectNotesDirs(project) { L269: const claudeProjects = join(homedir(), ".claude", "projects"); L270: if (!existsSync(claudeProjects)) return []; ... L724: * Returns the new path on success, or undefined if ambiguous/not found.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/pick-D7-XuJqF.mjsView on unpkg · L21

dist/daemon-mcp/index.mjsView file

140try { L141: new Function(""); L142: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/daemon-mcp/index.mjsView on unpkg · L140

scripts/build-docs.mjsView file

335L336: const mod = await import(pathToFileURL(PROGRAM_MJS).href); L337: if (typeof mod.buildProgram !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build-docs.mjsView on unpkg · L335

dist/hooks/capture-session-summary.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rt { writefilesync, mkdirsync, existssync as existssync2, readfilesync as readfilesync2, readdirsync } from "fs"; import { join as join2 } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (!trimmed || trimmed

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/capture-session-summary.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

dist/hooks/load-project-context.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tekmidian/pai@0.15.0 matchedIdentity = npm:QHRla21pZGlhbi9wYWk:0.15.0 similarity = 0.495 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/hooks/load-project-context.mjsView on unpkg

Source & flagged code

11 flagged · loading source

dist/checkpoint-block-D3rm4dAJ.mjsView file

635} L636: const { spawn } = await import("node:child_process"); L637: return new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/checkpoint-block-D3rm4dAJ.mjsView on unpkg · L635

dist/pick-D7-XuJqF.mjsView file

3745], L3746: shell: true L3747: });

High

Shell

Package source references shell execution.

dist/pick-D7-XuJqF.mjsView on unpkg · L3745

Findings

1 Critical6 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/hooks/load-project-context.mjs

HighChild Processdist/checkpoint-block-D3rm4dAJ.mjs

HighShelldist/pick-D7-XuJqF.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-session-summary.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/pick-D7-XuJqF.mjs

HighCross File Remote Execution Contextdist/pick-D7-XuJqF.mjs

HighTrigger Reachable Persistencedist/pick-D7-XuJqF.mjs

MediumDynamic Requirescripts/build-docs.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/pick-D7-XuJqF.mjs

Medium

Affected versions and remediation

This report applies to @tekmidian/pai@0.35.0.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.35.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:27:27.522Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.