registry / pi-experiences / 0.1.19

pi-experiences@0.1.19

A Pi extension package for capturing and reviewing behavioral experience patterns separately from skills and memory.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Pi agent-experience extension with explicit user-command setup, local private-state storage, redaction, and optional configured-model calls.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs Pi /experience commands or the explicit experience-consolidate CLI; package install alone has no install hook.

Impact

Can create/update package-owned config, observation, ledger, lock, and safety files under ~/.agents/experience after user-enabled features; no exfiltration or unconsented install-time control mutation found.

Mechanism

package-aligned local agent extension and CLI

Rationale

Static inspection shows package-aligned, gated Pi extension behavior rather than malicious install-time mutation, credential theft, payload loading, or exfiltration. Scanner findings map to redaction/env/config/test fixtures and wildcard peer deps, not a concrete attack chain.

Evidence

package.jsonbin/experience-consolidate.mjsextensions/agent-experience/index.tsextensions/agent-experience/src/paths.tsextensions/agent-experience/src/storage/observations.tsextensions/agent-experience/src/storage/redaction.tsextensions/agent-experience/src/selector-model.tsscripts/test-agent-experience-phase2-storage.mjs~/.agents/experience/agent-experience.toml~/.agents/experience/observations.jsonl~/.agents/experience/ledger.sqlite~/.agents/experience/analyze.lock~/.agents/experience/law.md

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall scripts; only prepack/prepublishOnly build/check scripts.
bin/experience-consolidate.mjs is an explicit CLI that reads package state and requires fixture output for now runs.
extensions/agent-experience/index.ts registers Pi commands/hooks, but capture/selector/model use are gated by local config and setup commands.
extensions/agent-experience/src/paths.ts writes only package-owned ~/.agents/experience config with timer/break-in forced off.
extensions/agent-experience/src/storage/observations.ts stores redacted observations locally under the private state root.
scripts/test-agent-experience-phase2-storage.mjs contains fake test token strings used to validate redaction.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

WildcardDependency

scanned 38 file(s), 506 KB of source

Source & flagged code

2 flagged

scripts/test-agent-experience-phase2-storage.mjsView file

Lines 84-124javascript

84const aliasFile = resolvePrivatePath(aliasRoot, 'ok.txt');

85const aliasHandle = await openSensitiveFileForWrite(aliasRoot, aliasFile);

86await aliasHandle.writeFile('ok');

87await aliasHandle.close();

88assert.equal(await privateStatMode(join(realParent, 'state', 'ok.txt')), 0o600, 'symlinked parent root should still permit contained writes');

90const sensitive = {

91 email: 'phase2@example.invalid',

92 phone: '+1 212 555 0101',

93 apiKey: 'sk_phase2_fake_token_1234567890',

94 nested: { authorization: 'Bearer phase2fake1234567890', path: '/home/example/private-file', macPath: '/Users/example/private-file' },

95};

96const redacted = redactJson(sensitive);

97assert.equal(containsUnredactedSensitiveText(redacted), false, 'redacted JSON must contain no sensitive fixture text');

98assert.equal(containsUnredactedSensitiveText(redactText(JSON.stringify(sensitive))), false, 'redacted text must contain no sensitive fixture text');

99assert.equal(containsUnredactedSensitiveText('api_key=abcdefghijklmnopqrstuvwxyz'), true);

100assert.equal(containsUnredactedSensitiveText('api_key="abcdefghijklmnopqrstuvwxyz"'), true);

101assert.equal(containsUnredactedSensitiveText(redactText('api_key="abcdefghijklmnopqrstuvwxyz"')), false);

102assert.equal(containsUnredactedSensitiveText(redactText('api_key=abcdefghijklmnopqrstuvwxyz')), false);

103assert.equal(containsUnredactedSensitiveText('aaaabbbbccccddddeeeeffff.gggghhhhiiiijjjjkkkkllll.mmmmnnnnooooppppqqqqrrrr'), true);

104assert.equal(containsUnredactedSensitiveText(redactText('-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----')), false);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L104

Critical

Secret Pattern

RSA private key in scripts/test-agent-experience-phase2-storage.mjs

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L104

105assert.equal(containsUnredactedSensitiveText('/tmp/pi-secret-file'), true);

106assert.equal(containsUnredactedSensitiveText('/media/misunderstood/DATA/private'), true);

107assert.equal(containsUnredactedSensitiveText(redactText('/media/misunderstood/DATA/private')), false);

108assert.equal(sensitive.email, 'phase2@example.invalid', 'redactJson must not mutate caller input');

109

110const a = { b: 2, a: { z: 9, c: 3 } };

111const b = { a: { c: 3, z: 9 }, b: 2 };

112assert.equal(canonicalJson(a), canonicalJson(b));

113assert.equal(checksumJson(a), checksumJson(b));

114assert.notEqual(checksumJson(a), checksumJson({ ...a, b: 3 }));

115

116await assert.rejects(() => initExperienceStorage(root, { allowInit: false }), /allowInit=true/);

117const storage = await initExperienceStorage(root, { allowInit: true, userId: 'user-a' });

118let backup;

119try {

120 assert.equal(storage.userId, 'user-a');

121 const hotPathStorage = await openExistingExperienceStorage(root, { userId: 'user-a' });

122 assert.equal(hotPathStorage.userId, 'user-a');

123 hotPathStorage.db.close();

124 assert.equal(await privateStatMode(storage.dbPath), 0o600, 'sqlite db must be 0600');

Source & flagged code

2 flagged · loading source

scripts/test-agent-experience-phase2-storage.mjsView file

104patternName = private_key_rsa severity = critical line = 104 matchedText = assert.e...se);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L104

104patternName = private_key_rsa severity = critical line = 104 matchedText = assert.e...se);

Critical

Secret Pattern

RSA private key in scripts/test-agent-experience-phase2-storage.mjs

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L104

Findings

2 Critical2 Medium4 Low

CriticalCritical Secretscripts/test-agent-experience-phase2-storage.mjs

CriticalSecret Patternscripts/test-agent-experience-phase2-storage.mjs

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings