PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 3d ago · by lpm-firewall-ai
The inspected embedding module does not support the reported exfiltration finding, and the manifest has no install lifecycle hook. The large, manifest-reachable CLI contains agent settings code and could not be fully reviewed here, so the reported credential-redirection behavior remains unresolved.
Unresolved; the inspected source does not establish an activating path for the reported behavior.
Impact
No malicious impact was confirmed; credential exposure or agent configuration changes remain unresolved in the unreviewed CLI behavior.
Mechanism
The inspected embedding code uses a configurable Ollama endpoint defaulting to localhost and provisions a local model; the CLI excerpt shows Claude settings access, with its complete behavior unresolved.
AI rationale
The inspected embedding module does not support the reported exfiltration finding, and the manifest has no install lifecycle hook. The large, manifest-reachable CLI contains agent settings code and could not be fully reviewed here, so the reported credential-redirection behavior remains unresolved.
AI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
package.json exposes CLI and daemon entrypoints and has a prepublishOnly script; it does not define preinstall, install, or postinstall hooks.
The inspected embedding backend posts text to its configured base URL, which defaults to localhost, and provisions a local Ollama model using a downloaded file and checksum.
The CLI includes code that reads and merges Claude settings, but the inspected excerpt does not establish its full setup trigger or effects.
Evidence against
The complete inspected embedding-gate module shows local Ollama embedding and checked model provisioning, not the flagged credential transfer.
1501* iTerm's split command parameter execs without a shell (proven live: panes
L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on
L1503: * `export …; …` or a redirect), so the command must be one exec-able line.
import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs";
L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ...
L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs";
...
L23: import { basename, dirname, join, relative, resolve } from "node:path";
L24: import { execFileSync, spawn } from "node:child_process";
L25: import { Document, parse } from "yaml";
...
L78: function agentsDir() {
L79: return join(homedir(), ".claude", "agents");
L80: }
...
L499: /**
L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
L501: * negated), fro
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
35Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } fr
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
35Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L51: import { parseDocument } from "yaml";
L52: imp
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
1501* iTerm's split command parameter execs without a shell (proven live: panes
L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on
L1503: * `export …; …` or a redirect), so the command must be one exec-able line.
9import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs";
L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ...
L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs";
...
L23: import { basename, dirname, join, relative, resolve } from "node:path";
L24: import { execFileSync, spawn } from "node:child_process";
L25: import { Document, parse } from "yaml";
...
L78: function agentsDir() {
L79: return join(homedir(), ".claude", "agents");
L80: }
...
L499: /**
L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
L501: * negated), fro
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
35Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } fr
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
35Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L51: import { parseDocument } from "yaml";
L52: imp
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.