PAI Knowledge OS — Personal AI Infrastructure with federated memory and project management
AI Security Review
scanned 3d ago · by lpm-firewall-ai
Source inspection did not substantiate the scanner’s exfiltration or credential-redirection claims. The inspected configuration mutation is confirmed by an explicit CLI prompt, and the inspected external download supports local model provisioning with integrity checks.
No malicious trigger was identified; settings changes occur during the explicit CLI setup flow after confirmation.
Impact
No confirmed malicious impact or credential transfer was established.
Mechanism
The inspected setup code merges PAI hooks and settings into Claude configuration after prompting, while model provisioning checks a downloaded file before local import.
AI rationale
Source inspection did not substantiate the scanner’s exfiltration or credential-redirection claims. The inspected configuration mutation is confirmed by an explicit CLI prompt, and the inspected external download supports local model provisioning with integrity checks.
Decision evidence
public snapshot
AI called this Clean at 79.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
package.json exposes import and CLI entrypoints; its only lifecycle script is prepublishOnly, so npm installation does not run setup code.
The CLI asks before patching Claude settings and returns without writing if declined; accepted setup merges PAI hooks and settings.
The flagged model provisioning code downloads a named Hugging Face model, checks its size and SHA256, then imports it into the local Ollama installation.
The flagged daemon operation saves a memory-search query and result summary locally; it does not perform an authenticated account action.
Evidence against
The inspected model download is tied to local embedding setup and integrity checks, not a credential recipient.
The inspected agent settings change is part of an explicit CLI setup flow with a confirmation prompt. The scanner labels alone do not establish malicious behavior.
1501* iTerm's split command parameter execs without a shell (proven live: panes
L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on
L1503: * `export …; …` or a redirect), so the command must be one exec-able line.
import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs";
L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ...
L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs";
...
L23: import { basename, dirname, join, relative, resolve } from "node:path";
L24: import { execFileSync, spawn } from "node:child_process";
L25: import { Document, parse } from "yaml";
...
L78: function agentsDir() {
L79: return join(homedir(), ".claude", "agents");
L80: }
...
L499: /**
L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
L501: * negated), fro
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
35Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } fr
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
35Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L51: import { parseDocument } from "yaml";
L52: imp
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
1501* iTerm's split command parameter execs without a shell (proven live: panes
L1502: * survive `sleep 30` and a single-quoted `/bin/sh -c`, die instantly on
L1503: * `export …; …` or a redirect), so the command must be one exec-able line.
9import { r as isLoopbackProvider } from "./run-env-DBJ8ml-Z.mjs";
L10: import { $ as waitingLine, D as bashExitCode, E as WAIT_EXIT_STILL_RUNNING, G as statusMarker, I as renderReport, J as detachedLine, K as statusQueue, O as isWaitPollCommand, P as ...
L11: import { E as probeLoopback, O as resolveLocalProvider, S as LOCAL_MECHANISM_LINE, k as resolveRunnerProvider } from "./budget-CuL0Q5aB.mjs";
...
L23: import { basename, dirname, join, relative, resolve } from "node:path";
L24: import { execFileSync, spawn } from "node:child_process";
L25: import { Document, parse } from "yaml";
...
L78: function agentsDir() {
L79: return join(homedir(), ".claude", "agents");
L80: }
...
L499: /**
L500: * `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
L501: * negated), fro
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
dir(), "pai-sk[redacted]");
if (!existssync(templatepath)) {
console.log(c.warn("skill template not found: " + templatepath));
console.log(c.dim(" skipping pai skill installation."));
return false;
}
const skilldir = join(homedir(), ".claude", "skills", "pai");
const skillfile = join(skilldir, "skill.md");
if (existssync(skillfile)) {
const content = readfilesync(skillfile, "utf-8");
const isgenerated = content.includes("generated by pai setup");
if (isgenerated) console.log(c.dim(" found existing pai-generated skill.md."));
else {
console.log(c.yellow(" found existing skill.md (not pai-generated)."));
console.log(c.dim(" a backup will be created bef
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
35Cross-file remote execution chain: dist/cli/index.mjs spawns dist/daemon-mcp/index.mjs; helper contains network access plus dynamic code execution.
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } fr
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
35Trigger-reachable persistence chain: manifest.bin -> dist/cli/index.mjs
L35: import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BZlFbryO.mjs";
L36: import { $ as realPaneOps, A as finishDetached, B as realRunnerDeps, Bt as readRunLock, C as onBattery, Ct as PlanError, D as writePolicy, Dt as runLogPath, E as routeRun, Et as lo...
L37: import { _ as buildSlots, a as buildNext, b as testSlots, c as getTicket, d as patchTicket, g as tryStart, h as ticketKind, i as buildLogPath, l as listBuilds, m as renderBuildQueu...
...
L49: import chalk from "chalk";
L50: import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L51: import { parseDocument } from "yaml";
L52: imp
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.