Loading npm security reports…

@vanillagreen/pi-questions@2.0.0: AI-agent control-surface risk | LPM Firewall

registry / @vanillagreen/pi-questions / 2.0.0

@vanillagreen/pi-questions@2.0.0

Pi extension for structured multi-tab inline questions and bridge-driven replies.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The automatic install hook modifies Pi's shared system-prompt file. Outside managed extension installations, it can modify the existing user-wide Pi prompt without explicit approval.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall when a Pi scope or existing user directory is found.

Impact

Package installation changes instructions governing subsequent agent behavior across the selected Pi scope.

Mechanism

The helper reads instructions.md, wraps its contents in package markers, and writes them into APPEND_SYSTEM.md.

Policy narrative

Installation automatically invokes a helper that locates a Pi scope, including a fallback to the existing user-wide directory. It inserts package-supplied behavioral instructions into the shared system prompt. Package markers limit the inserted block but do not provide consent for altering this broader agent control surface.

AI rationale

Source shows an unconsented postinstall write to a foreign, shared AI-agent control surface, including a user-wide fallback. This meets the blocking policy despite the package-aligned instruction content and absence of observed exfiltration.

Evidence

package.jsonscripts/append-system.mjsinstructions.mdAPPEND_SYSTEM.md

Decision evidence

public snapshot

AI identified this as a at 94.0% confidence with false-positive risk.

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/append-system.mjs install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"postinstall": "node scripts/append-system.mjs install", "preuninstall": "node scripts/append-system.mjs remove" }, "p

High

Suspicious Lifecycle Evidence

package.json automatically runs the prompt-writing helper during postinstall.

package.jsonView on unpkg · L21

•scripts.postinstall = node scripts/append-system.mjs install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/append-system.mjsView file

59const target = join(scopeRoot, "APPEND_SYSTEM.md"); const begin = ``; const end = ``; try

High

Ai Review Evidence

scripts/append-system.mjs targets Pi's shared APPEND_SYSTEM.md and falls back to the existing user-wide Pi directory without a consent check.

scripts/append-system.mjsView on unpkg · L59

130function upsertBlock(target, begin, end, content) { mkdirSync(dirname(target), { recursive: true }); const stripped = strippedExisting(target, begin, end); const block = `${begin}\n${content}\n${end}`; const next = stripped ? `${stripped}\n\n${block}\n` : `${block}\n`; writeFileSync(target, next); } function removeBlock(target, b

High

Ai Review Evidence

scripts/append-system.mjs appends package instructions and writes the shared prompt file.

scripts/append-system.mjsView on unpkg · L130

instructions.mdView file

5Use when: the next action depends on a choice only the user can make (which file, which approach, which environment); the request is ambiguous in a way prose paraphrasing won't resolve; you need confirmation before an irreversible/high-blast-radius action (deletes, force-pushes, sending external messages). Do not use for: simple yes/no that fits in conversation;

High

Ai Review Evidence

instructions.md supplies rules governing the agent's clarification and confirmation behavior.

instructions.mdView on unpkg · L5

Source & flagged code

6 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@vanillagreen/pi-questions",

3 "version": "2.0.0",

4 "description": "Pi extension for structured multi-tab inline questions and bridge-driven replies.",

5 "license": "MIT",

6 "keywords": [

7 "pi-package",

8 "pi",

9 "coding-agent",

10 "questions",

11 "prompt"

12 ],

13 "pi": {

14 "extensions": [

15 "./extensions/questions.ts"

16 ],

17 "image": "https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-questions/assets/questions-workflow.gif",

18 "appendSystem": "./instructions.md"

19 },

20 "scripts": {

21 "postinstall": "node scripts/append-system.mjs install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "preuninstall": "node scripts/append-system.mjs remove"

23 },

24 "peerDependencies": {

High

Suspicious Lifecycle Evidence

package.json automatically runs the prompt-writing helper during postinstall.

package.jsonView on unpkg · L21

25 "@earendil-works/pi-coding-agent": "*",

26 "@earendil-works/pi-tui": "*"

27 },

28 "files": [

29 "extensions/",

30 "assets/",

31 "scripts/",

32 "instructions.md",

33 "README.md",

34 "package.json"

35 ],

36 "kendex": {

37 "extensionManager": {

38 "displayName": "Questions",

39 "settings": [

40 {

41 "key": "enabled",

scripts/append-system.mjsView file

Lines 39-79javascript

39try {

40 pkg = JSON.parse(readFileSync(join(pkgDir, "package.json"), "utf8"));

41} catch (err) {

42 console.error(`append-system.mjs: unable to read package.json in ${

instructions.mdView file

Lines 1-17markdown

1## pi-questions — `question` tool

2

3For explicit clarification when the answer materially changes the plan. Prose questions buried in your reply are easier to miss and harder to act on.

4

5Use when: the next action depends on a choice only the user can make (which file, which approach, which environment); the request is ambiguous in a way prose paraphrasing won't resolve; you need confirmation before an irreversible/high-blast-radius action (deletes, force-pushes, sending external messages).

6

7Do not use for: simple yes/no that fits in conversation; anything you can determine yourself by reading the code; speculative "would you like me to also…" follow-ups — finish the asked work first.

High

Ai Review Evidence

instructions.md supplies rules governing the agent's clarification and confirmation behavior.

instructions.mdView on unpkg · L5