Loading npm security reports…

@vanillagreen/pi-task-panel@3.0.2: AI-agent control-surface risk | LPM Firewall

registry / @vanillagreen/pi-task-panel / 3.0.2

@vanillagreen/pi-task-panel@3.0.2

Persistent Claude-style tasks panel for Pi with slash commands and a structured tasks_write tool.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation modifies Pi's shared agent instruction file. The fallback reaches existing user-wide agent configuration without an explicit setup command or consent gate.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall when a managed scope or existing Pi user directory is found.

Impact

Persistently changes agent task-tool and reply behavior across sessions using the affected Pi scope.

Mechanism

Read package instructions and upsert a marked block into APPEND_SYSTEM.md.

Policy narrative

Installing the package automatically runs its instruction installer. Even outside a managed extension installation, the script locates an existing Pi user directory and inserts package instructions into its shared APPEND_SYSTEM.md. Those instructions prescribe tool use and response behavior. Package-specific markers and uninstall cleanup limit the edit, but do not provide consent for changing the broader agent control surface.

AI rationale

The source establishes an unconsented postinstall mutation of a shared AI-agent control surface, including a user-wide fallback. Under the supplied policy, this warrants blocking despite the task-related payload and absence of exfiltration. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/append-system.mjsinstructions.mdAPPEND_SYSTEM.md

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/append-system.mjs install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"postinstall": "node scripts/append-system.mjs install", "preuninstall": "node scripts/append-system.mjs remove" }, "kendex"

High

Suspicious Lifecycle Evidence

package.json automatically runs the system-instruction installer during postinstall.

package.jsonView on unpkg · L21

•scripts.postinstall = node scripts/append-system.mjs install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/append-system.mjsView file

66const target = join(scopeRoot, "APPEND_SYSTEM.md"); const begin = ``; const end = `<!-- kendex:append-system ${name} end --

High

Ai Review Evidence

The installer targets Pi's shared APPEND_SYSTEM.md rather than a package-local configuration file.

scripts/append-system.mjsView on unpkg · L66

113const configured = process.env.PI_CODING_AGENT_DIR; const piDir = configured ? resolve(configured.replace(/^~(?=\/|$)/, homedir())) : join(homedir(), ".pi", "agent"); return existsSync(piDir) ? piDir : undefined; } function isPiScopeRoot(scopeRoot) { if (existsSync(j

High

Ai Review Evidence

Outside managed installs, the installer falls back to an existing user-wide Pi directory without requesting consent.

scripts/append-system.mjsView on unpkg · L113

143function upsertBlock(target, begin, end, content) { mkdirSync(dirname(target), { recursive: true }); const stripped = strippedExisting(target, begin, end); const block = `${begin}\n${content}\n${end}`; const next = stripped ? `${stripped}\n\n${block}\n` : `${block}\n`; writeFileSync(target, next); } function removeBlock(ta

High

Ai Review Evidence

Installation reads the instruction payload and writes it into the shared file inside package-named markers.

scripts/append-system.mjsView on unpkg · L143

instructions.mdView file

14- Never end a turn with a stale `in_progress` task. If work has moved on, `start_task` the right one or `drop_task` it before replying. - Do not narrate task transitions in prose ("now I'll start X") — just call the tool. - For one-shot trivial reque

High

Ai Review Evidence

instructions.md imposes task-tool usage and reply behavior on the agent.

instructions.mdView on unpkg · L14

Source & flagged code

7 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@vanillagreen/pi-task-panel",

3 "version": "3.0.2",

4 "description": "Persistent Claude-style tasks panel for Pi with slash commands and a structured tasks_write tool.",

5 "license": "MIT",

6 "keywords": [

7 "pi-package",

8 "pi",

9 "coding-agent",

10 "tasks"

11 ],

12 "pi": {

13 "extensions": [

14 "./extensions/task-panel.ts"

15 ],

16 "image": "https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-task-panel/assets/panel-expanded.png",

17 "appendSystem": "./instructions.md"

18 },

19 "scripts": {

20 "test": "bun test ./tests",

21 "postinstall": "node scripts/append-system.mjs install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "preuninstall": "node scripts/append-system.mjs remove"

23 },

24 "kendex": {

High

Suspicious Lifecycle Evidence

package.json automatically runs the system-instruction installer during postinstall.

package.jsonView on unpkg · L21

25 "extensionManager": {

26 "displayName": "Task Panel",

27 "settings": [

28 {

29 "key": "enabled",

30 "label": "Enable task panel",

31 "description": "Register tasks_write, /tasks, task panel widgets, reminders, and shortcuts.",

32 "type": "boolean",

33 "default": true,

34 "category": "General",

35 "apply": "reload",

36 "requiresReload": true

37 },

38 {

39 "key": "glyphStyle",

40 "label": "Glyph style",

41 "description": "Glyphs for kendex-owned UI chrome. Unicode is the default; ASCII uses plain box/status/separator characters for terminal compatibility. pi-tool-renderer's global override wins when set.",

scripts/append-system.mjsView file

Lines 46-86javascript

46try {

47 pkg = JSON.parse(readFileSync(join(pkgDir, "package.json"), "utf8"));

48} catch (err) {

49 notice("package-read"

instructions.mdView file

Lines 1-18markdown

1## pi-task-panel — `tasks_write` tool

2

3The Pi `tasks_write` tool is the only way the user sees what you're working on. Writing tasks once and ignoring them is the most common failure mode — keep the panel current throughout the turn, not only at the final reply.

4

5Use:

6

7- Before any non-trivial multi-step work, `action: "replace"` with a full `tasks: [...]` list.

8- The moment you start an item,

Lines 93-163javascript

93 // Never fail the npm install/uninstall over an APPEND_SYSTEM.md write.

94 notice("operation", `${action}:${name}:${err?.code ?? "unknown"}`, `Unable to update APPEND_SYSTEM.md: ${err?.message ?? err}`);

95 process.exit(0);

96}

97

98function findScopeRoot(start) {

99 let dir = start;

100 while (true) {

101 const parent = dirname(dir);

102 if (parent === dir) break;

103 if (basename(parent) === "packages") return dirname(parent);

104 if (basename(parent) === "node_modules" && basename(dirname(parent)) === "npm") {

105 const scopeRoot = dirname(dirname(parent));

106 if (isPiScopeRoot(scopeRoot)) return scopeRoot;

107 }

108 dir = parent;

109 }

110 // Fallback: the conventional Pi user dir, but only when it already exists.

111 // This catches legacy global-prefix installs without mutating arbitrary user

112 // state on machines without Pi installed.

113 const configured = process.env.PI_CODING_AGENT_DIR;

114 const piDir = configured ? resolve(configured.replace(/^~(?=\/|$)/, homedir())) : join(homedir(), ".pi", "agent");

115 return existsSync(piDir) ? piDir : undefined;

116}

117

118function isPiScopeRoot(scopeRoot) {

119 if (existsSync(join(scopeRoot, "settings.json"))) return true;

High

Ai Review Evidence

Outside managed installs, the installer falls back to an existing user-wide Pi directory without requesting consent.

scripts/append-system.mjsView on unpkg · L113

120 if (basename(scopeRoot) === ".pi") return true;

121 const configured = process.env.PI_CODING_AGENT_DIR;

122 const piDir = configured ? resolve(configured.replace(/^~(?=\/|$)/, homedir())) : join(homedir(), ".pi", "agent");

123 return resolve(scopeRoot) === resolve(piDir);

124}

125

126function escapeRegExp(s) {

127 return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

128}

129

130function strippedExisting(target, begin, end) {

131 if (!existsSync(target)) return "";

132 // Splice the begin..end span out without touching surrounding newlines,

133 // then collapse 3+ consecutive newlines so a removed sandwiched block

134 // doesn't leave a gap. trim leading/trailing newlines last.

135 const re = new RegExp(`${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}`, "g");

136 return readFileSync(target, "utf8")

137 .replace(re, "")

138 .replace(/\n{3,}/g, "\n\n")

139 .replace(/^\n+/, "")

140 .replace(/\n+$/, "");

141}

142

143function upsertBlock(target, begin, end, content) {

144 mkdirSync(dirname(target), { recursive: true });

145 const stripped = strippedExisting(target, begin, end);

146 const block = `${begin}\n${content}\n${end}`;

147 const next = stripped ? `${stripped}\n\n${block}\n` : `${block}\n`;

148 writeFileSync(target, next);

149}

150

151function removeBlock(target, begin, end) {

High

Ai Review Evidence

Installation reads the instruction payload and writes it into the shared file inside package-named markers.

scripts/append-system.mjsView on unpkg · L143

152 if (!existsSync(target)) return;

153 const stripped = strippedExisting(target, begin, end);

154 if (stripped) {

155 writeFileSync(target, `${stripped}\n`);

156 } else {

157 try {

158 unlinkSync(target);

159 } catch (err) {

160 if (err?.code !== "ENOENT") throw err;

161 }

162 }

163}