@tekmidian/pai@0.36.1

PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package has a guarded, first-party agent setup capability that merits a warning under the agent integration policy. Inspected sources do not establish unconsented installation-time mutation, credential exfiltration, or another concrete attack.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the PAI setup command and accepts the relevant prompts.

Impact

Accepted setup changes the agent’s user-level instructions and adds PAI skills; the inspected sources do not show a foreign control-surface takeover.

Mechanism

The setup copies package templates into the user’s Claude configuration; session hooks also process session data and write PAI summaries.

AI rationale

Evidence

~/.claude/CLAUDE.md~/.claude/skills/PAI/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has no install lifecycle hook; its only publish lifecycle script runs the build.
The CLI setup command can write PAI-provided instructions into Claude’s user configuration.
Updating an existing PAI skill prompts the user and preserves the file if declined.
The session summary hook processes session input and launches a detached background copy to save a summary.

Evidence against

The setup writes package-owned agent instructions and skills, with prompts before changing existing files.
The inspected hook locations read PAI environment configuration; they do not establish an unrelated control-surface write or credential transfer.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

dist/context-handover-cache-PtNvj_8D.mjsView file

Lines 616-656javascript

616 if (existsSync(candidate)) return candidate;

617 } catch {}

618 return "claude";

619}

620const CLAUDE_TIMEOUT_MS = {

621 haiku: 6e4,

622 sonnet: 12e4,

623 opus: 3e5

624};

625/**

626* Spawn the claude CLI with a prompt on stdin and return stdout.

627*

628* IMPORTANT: ANTHROPIC_API_KEY is stripped from the spawned environment so

629* the CLI uses the user's Max plan (free) instead of billing the API key.

630*/

631async function spawnClaude(prompt, model = "sonnet") {

632 const claudeBin = findClaudeBinary();

633 if (!claudeBin) {

634 process.stderr.write("[kg-extraction] claude CLI not found.\n");

635 return null;

636 }

637 const { spawn } = await import("node:child_process");

638 return new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/context-handover-cache-PtNvj_8D.mjsView on unpkg · L636

639 let timer = null;

640 const { ANTHROPIC_API_KEY: _drop, ...envWithoutApiKey } = process.env;

641 const child = spawn(claudeBin, [

642 "--model",

643 model,

644 "-p",

645 "--no-session-persistence"

646 ], {

647 env: envWithoutApiKey,

648 stdio: [

649 "pipe",

650 "pipe",

651 "pipe"

652 ]

653 });

654 let stdout = "";

655 let stderr = "";

656 child.stdout.on("data", (chunk) => {

dist/program-C-fUghPv.mjsView file

3786], L3787: shell: true L3788: });

High

Shell

Package source references shell execution.

dist/program-C-fUghPv.mjsView on unpkg · L3786

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. l.template.md"); if (!existssync(templatepath)) { console.log(c.warn("skill template not found: " + templatepath)); console.log(c.dim(" skipping pai skill installation.")); return false; } const skilldir = join(homedir(), ".claude", "skills", "pai"); const skillfile = join(skilldir, "skill.md"); if (existssync(skillfile)) { const content = readfilesync(skillfile, "utf-8"); const isgenerated = content.includes("generated by pai setup"); if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md.")); else { console.log(c.yellow(" found existing skill.md (not pai-generated).")); console.log(c.dim(" a backup will be created before overwri

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/program-C-fUghPv.mjsView on unpkg

22Cross-file remote execution chain: dist/program-C-fUghPv.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution. L22: import { fileURLToPath } from "node:url"; L23: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process"; L24: import { createInterface } from "node:readline"; L25: import { createConnection } from "net"; L26: import { promisify } from "node:util"; ... L38: * 08 - Others/MDF/Infrastruktur/.claude/worktrees/strange-haibt 7 sessions L39: * /private/tmp/ops-webui dead L40: * /private/tmp/claude-501/-Users-…-AIBroker/aae854c6-… dead ... L266: function findProjectNotesDirs(project) { L267: const claudeProjects = join(homedir(), ".claude", "projects"

dist/daemon-mcp/index.mjsView file

Lines 120-160javascript

120 configurable: true

121 });

122}

123function mergeDefs(...defs) {

124 const mergedDescriptors = {};

125

scripts/build-docs.mjsView file

Lines 315-355javascript

315

316 out.push("## All commands", "");

317 out.push("| Command | Description |", "|---------|-------------|");

318 for (const c of flat) {

dist/hooks/capture-session-summary.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rt { writefilesync, mkdirsync, existssync as existssync2, readfilesync as readfilesync2, readdirsync } from "fs"; import { join as join2 } from "path"; import { homedir } from "os"; import { resolve, join } from "path"; import { existssync, readfilesync } from "fs"; function loadenvfile() { const possiblepaths = [ resolve(process.env.pai_dir || "", ".env"), resolve(homedir(), ".claude", ".env") ]; for (const envpath of possiblepaths) { if (existssync(envpath)) { try { const content = readfilesync(envpath, "utf-8"); for (const line of content.split("\n")) { const trimmed = line.trim(); if (!trimmed || trimmed

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/hooks/capture-session-summary.mjsView on unpkg

tab-color-command.shView file

•path = tab-color-command.sh kind = build_helper sizeBytes = 860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tab-color-command.shView on unpkg

Source & flagged code

10 flagged · loading source

dist/context-handover-cache-PtNvj_8D.mjsView file

636} L637: const { spawn } = await import("node:child_process"); L638: return new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/context-handover-cache-PtNvj_8D.mjsView on unpkg · L636

dist/program-C-fUghPv.mjsView file

3786], L3787: shell: true L3788: });

High

Shell

Package source references shell execution.

dist/program-C-fUghPv.mjsView on unpkg · L3786

Findings

6 High6 Medium6 Low

HighChild Processdist/context-handover-cache-PtNvj_8D.mjs

HighShelldist/program-C-fUghPv.mjs

HighExternal Ai Agent Control Surface Mutationdist/hooks/capture-session-summary.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/program-C-fUghPv.mjs

HighCross File Remote Execution Contextdist/program-C-fUghPv.mjs

HighTrigger Reachable Persistencedist/program-C-fUghPv.mjs

MediumDynamic Requirescripts/build-docs.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/program-C-fUghPv.mjs

MediumShips Build Helpertab-color-command.sh

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @tekmidian/pai@0.36.1.

See all versions of @tekmidian/pai for other recorded verdicts.

Review the evidence and your use of @tekmidian/pai@0.36.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:21:36.757Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code