Loading npm security reports…
First-party Pi web tools: provider-toggled web search, Exa deep research, content retrieval, and OpenAI native web_search integration.
LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically adds extension instructions to Pi's system prompt file. Opt-in Gemini authentication also has conditional cookie exposure through unrestricted redirects; no confirmed active attack was established.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json automatically runs the prompt helper after installation and before uninstall.
package.jsonView on unpkg · L216The helper writes a package-named instruction block into APPEND_SYSTEM.md, including an existing user-wide Pi directory.
scripts/append-system.mjsView on unpkg · L66This report applies to @vanillagreen/pi-web-tools@4.0.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L216Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L216package.json automatically runs the prompt helper after installation and before uninstall.
package.jsonView on unpkg · L216The helper writes a package-named instruction block into APPEND_SYSTEM.md, including an existing user-wide Pi directory.
scripts/append-system.mjsView on unpkg · L66