registry  /  @wwjd/pi-graphify  /  0.2.0

@wwjd/pi-graphify@0.2.0

Graphify knowledge graph integration for Pi coding agent

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The extension runs local Graphify version/help probes when a Pi session starts and exposes project graph status.

Static reason
No blocking static signals were detected.
Trigger
Pi extension session_start or a registered Graphify status command/tool
Impact
Executes an already-installed local graphify binary; no package-originated network, persistence, credential, or destructive behavior found.
Mechanism
Local Graphify CLI integration via execFile argument arrays
Rationale
Source inspection shows a package-aligned Pi extension that invokes a local Graphify CLI without install hooks, network access, data exfiltration, or filesystem mutation. The observed child-process use is constrained to fixed executable discovery and argument-array CLI calls.
Evidence
package.jsonextensions/index.tssrc/backends/cli.tssrc/version.tssrc/coordinator.tssrc/graphify.ts

Decision evidence

public snapshot
AI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `extensions/index.ts` initializes the backend on Pi session start.
  • `src/backends/cli.ts` invokes the locally installed `graphify` CLI through `execFile`.
  • `src/version.ts` probes `graphify` version and help commands at runtime.
Evidence against
  • `package.json` has no preinstall, install, postinstall, or bin entrypoint.
  • No source code performs network requests, credential harvesting, or file writes.
  • CLI arguments are passed as arrays to `execFile`; no eval or dynamic payload loading is present.
  • The extension only checks `graphify-out/graph.json` and registers status-oriented Pi integration.
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 10 file(s), 28.8 KB of source

Source & flagged code

3 flagged · loading source
extensions/index.tsView file
•Published source reference
Low
Ai Review Evidence

`extensions/index.ts` initializes the backend on Pi session start.

extensions/index.tsView on unpkg
src/backends/cli.tsView file
•Published source reference
Low
Ai Review Evidence

`src/backends/cli.ts` invokes the locally installed `graphify` CLI through `execFile`.

src/backends/cli.tsView on unpkg
src/version.tsView file
•Published source reference
Low
Ai Review Evidence

`src/version.ts` probes `graphify` version and help commands at runtime.

src/version.tsView on unpkg

Findings

5 Low
LowScripts Present
LowFilesystem
LowAi Review Evidenceextensions/index.ts
LowAi Review Evidencesrc/backends/cli.ts
LowAi Review Evidencesrc/version.ts