registry / pi-aftc-toolset / 1.2.4

pi-aftc-toolset@1.2.4

AFTC productivity toolset for pi — footer diagnostics, SQLite model usage reports, cache analysis, input shortcuts, cache-audit skill, theme, and SSH tools backed by a PyQt6 GUI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

An agent invokes `ssh_connect`/`ssh_run`, or a user runs `/aftc-install` and confirms.

Impact

An agent with access to supplied SSH credentials can execute arbitrary commands on the selected remote host and read returned output.

Mechanism

Local Flask bridge forwards AI tool input to Paramiko SSH and executes remote shell commands.

Rationale

The source implements an explicit SSH automation feature rather than a covert malicious chain, but it exposes unrestricted remote command execution to the agent and downloads an executable without integrity verification. Warn rather than block because activation is tool/user-driven and no concrete malicious behavior is present.

Evidence

package.jsonextensions/toolset/index.tsextensions/toolset/install.tsextensions/toolset/ssh.tsinternal-python-gui/main.pyinternal-python-gui/bin/uv.exeinternal-python-gui/std/in.txtinternal-python-gui/std/out.txtinternal-python-gui/std/err.txt.pi-aftc-toolset/data/turns.db

Network endpoints2

127.0.0.85:8564/api/v1github.com/astral-sh/uv/releases/latest/download/uv-x86_64-pc-windows-msvc.exe

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`extensions/toolset/ssh.ts` registers AI-callable SSH connect/run tools that forward arbitrary commands.
`internal-python-gui/main.py` executes queued commands over Paramiko SSH and returns terminal output.
`extensions/toolset/install.ts` can download and execute `uv.exe` without checksum verification after explicit confirmation.
A 62 MB native executable is shipped at `internal-python-gui/bin/uv.exe`.

Evidence against

`package.json` has no npm lifecycle scripts.
Install actions are exposed through the explicit `/aftc-install` command and UI confirmation.
SSH HTTP traffic is restricted to local `127.0.0.85:8564`; no source exfiltration endpoint was found.
SQLite storage is limited to local usage metrics under `.pi-aftc-toolset/data/`.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 229 KB of source, external domains: 127.0.0.85, github.com

Source & flagged code

4 flagged

tests/full-check/full-check.mjsView file

Lines 155-195javascript

155if (!m2) { console.error(" FAIL: no module script"); allOk = false; }

156else {

157 // Don't pre-declare `data` — the module script does its own `const data = JSON.parse(...)`.

158 // The stub DOM just needs to exist and provide enough scaffolding.

159 const stubs = `

160 const _els = {};

161 const _fakeEl = (id) => ({

162 textContent: id === "report-data" ? "{}" : "",

163 innerHTML: "", id, style: {}, classList: { toggle: () => {}, add: () => {}, remove: () => {} },

164 addEventListener: function() {}, appendChild() {}, querySelectorAll: () => [],

165 querySelector: () => null, getBoundingClientRect: () => ({}), dataset: {},

166 lastElementChild: null, children: { length: 0 },

167 });

168 const document = {

169 getElementById: (id) => _els[id] || (_els[id] = _fakeEl(id)),

170 createElement: () => ({ className: "", innerHTML: "", style: {}, appendChild() {} }),

171 querySelectorAll: () => [],

172 };

173 `;

174 const fullScript = stubs + "\n" + m2[1];

175 try {

176 new Function(fullScript)();

177 console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L175

178 } catch (e) {

179 if (e instanceof SyntaxError) {

180 console.error(" FAIL SyntaxError: " + e.message);

181 allOk = false;

182 } else {

183 // Runtime errors are expected — stubs don't implement full DOM

184 console.log(" OK no syntax error (stub runtime: " + e.message + ")");

185 }

186 }

187}

188

189console.log(allOk ? "\nALL HTML CHECKS PASSED" : "\nSOME HTML CHECKS FAILED");

190

191// ---------- 6. End to end: confirm full file pipeline ----------

192// Re-parse via jiti after the HTML was regenerated — make sure nothing breaks.

193jiti(`${ROOT}/extensions/toolset/usage-report.ts`);

194console.log("\n=== FINAL RE-PARSE ===");

195console.log(" OK");

tests/load-test/load-test.cjsView file

Lines 1-26javascript

1// Load-test harness for extensions/toolset/index.ts — no API calls, no TUI.

2// Uses pi's bundled jiti to load the TS extension with a stub ExtensionAPI.

3// Resolve the globally-installed pi package portably via `npm root -g`.

4// Exercises the factory, every event handler, every slash command, and

5// the widget render path end-to-end against a real SQLite DB so we

6// verify per-turn recording actually inserts rows.

7const { execSync } = require("node:child_process");

8const globalRoot

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

Source & flagged code

4 flagged · loading source

tests/full-check/full-check.mjsView file

175try { L176: new Function(fullScript)(); L177: console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L175

tests/load-test/load-test.cjsView file

6// verify per-turn recording actually inserts rows. L7: const { execSync } = require("node:child_process"); L8: const globalRoot = execSync("npm root -g", { encoding: "utf8" }).trim();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/load-test/load-test.cjsView on unpkg · L6

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

Findings

6 Medium4 Low

MediumDynamic Requiretests/load-test/load-test.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryinternal-python-gui/bin/uv.exe

MediumShips Build Helperinternal-python-gui/main.py

MediumStructural Risk Force Deep Review

LowEvaltests/full-check/full-check.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

tests/full-check/full-check.mjsView file

Lines 155-195javascript

155if (!m2) { console.error(" FAIL: no module script"); allOk = false; }

156else {

157 // Don't pre-declare `data` — the module script does its own `const data = JSON.parse(...)`.

158 // The stub DOM just needs to exist and provide enough scaffolding.

159 const stubs = `

160 const _els = {};

161 const _fakeEl = (id) => ({

162 textContent: id === "report-data" ? "{}" : "",

163 innerHTML: "", id, style: {}, classList: { toggle: () => {}, add: () => {}, remove: () => {} },

164 addEventListener: function() {}, appendChild() {}, querySelectorAll: () => [],

165 querySelector: () => null, getBoundingClientRect: () => ({}), dataset: {},

166 lastElementChild: null, children: { length: 0 },

167 });

168 const document = {

169 getElementById: (id) => _els[id] || (_els[id] = _fakeEl(id)),

170 createElement: () => ({ className: "", innerHTML: "", style: {}, appendChild() {} }),

171 querySelectorAll: () => [],

172 };

173 `;

174 const fullScript = stubs + "\n" + m2[1];

175 try {

176 new Function(fullScript)();

177 console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L175

178 } catch (e) {

179 if (e instanceof SyntaxError) {

180 console.error(" FAIL SyntaxError: " + e.message);

181 allOk = false;

182 } else {

183 // Runtime errors are expected — stubs don't implement full DOM

184 console.log(" OK no syntax error (stub runtime: " + e.message + ")");

185 }

186 }

187}

188

189console.log(allOk ? "\nALL HTML CHECKS PASSED" : "\nSOME HTML CHECKS FAILED");

190

191// ---------- 6. End to end: confirm full file pipeline ----------

192// Re-parse via jiti after the HTML was regenerated — make sure nothing breaks.

193jiti(`${ROOT}/extensions/toolset/usage-report.ts`);

194console.log("\n=== FINAL RE-PARSE ===");

195console.log(" OK");

tests/load-test/load-test.cjsView file

Lines 1-26javascript

1// Load-test harness for extensions/toolset/index.ts — no API calls, no TUI.

2// Uses pi's bundled jiti to load the TS extension with a stub ExtensionAPI.

3// Resolve the globally-installed pi package portably via `npm root -g`.

4// Exercises the factory, every event handler, every slash command, and

5// the widget render path end-to-end against a real SQLite DB so we

6// verify per-turn recording actually inserts rows.

7const { execSync } = require("node:child_process");

8const globalRoot

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg