registry / @vanillagreen/pi-task-panel / 3.0.1

@vanillagreen/pi-task-panel@3.0.1

⚠ Under review

Persistent Claude-style tasks panel for Pi with slash commands and a structured tasks_write tool.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 83.7 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-41json

2 "name": "@vanillagreen/pi-task-panel",

3 "version": "3.0.1",

4 "description": "Persistent Claude-style tasks panel for Pi with slash commands and a structured tasks_write tool.",

5 "license": "MIT",

6 "keywords": [

7 "pi-package",

8 "pi",

9 "coding-agent",

10 "tasks"

11 ],

12 "pi": {

13 "extensions": [

14 "./extensions/task-panel.ts"

15 ],

16 "image": "https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-task-panel/assets/panel-expanded.png",

17 "appendSystem": "./instructions.md"

18 },

19 "scripts": {

20 "test": "bun test ./tests",

21 "postinstall": "node scripts/append-system.mjs install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "preuninstall": "node scripts/append-system.mjs remove"

23 },

24 "kendex": {

25 "extensionManager": {

26 "displayName": "Task Panel",

27 "settings": [

28 {

29 "key": "enabled",

30 "label": "Enable task panel",

31 "description": "Register tasks_write, /tasks, task panel widgets, reminders, and shortcuts.",

32 "type": "boolean",

33 "default": true,

34 "category": "General",

35 "apply": "reload",

36 "requiresReload": true

37 },

38 {

39 "key": "glyphStyle",

40 "label": "Glyph style",

41 "description": "Glyphs for kendex-owned UI chrome. Unicode is the default; ASCII uses plain box/status/separator characters for terminal compatibility. pi-tool-renderer's global override wins when set.",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/append-system.mjs install

High

Install Time Lifecycle Scripts

@vanillagreen/pi-task-panel@3.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code