registry / pi-experiences / 0.1.40

pi-experiences@0.1.40

Human-reviewed habits for Pi coding agents—a local-first behavioral learning layer alongside skills and memory.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 78 file(s), 1.33 MB of source, external domains: github.com, huggingface.co, raw.githubusercontent.com, unpkg.com, web.dev

Source & flagged code

4 flagged

scripts/test-agent-experience-phase2-storage.mjsView file

Lines 85-125javascript

85const aliasHandle = await openSensitiveFileForWrite(aliasRoot, aliasFile);

86await aliasHandle.writeFile('ok');

87await aliasHandle.close();

88assert.equal(await privateStatMode(join(realParent, 'state', 'ok.txt')), 0o600, 'symlinked parent root should still permit contained writes');

90const sensitive = {

91 email: 'phase2@example.invalid',

92 phone: '+1 212 555 0101',

93 apiKey: 'sk_phase2_fake_token_1234567890',

94 nested: { authorization: 'Bearer phase2fake1234567890', path: '/home/example/private-file', macPath: '/Users/example/private-file' },

95};

96const redacted = redactJson(sensitive);

97assert.equal(containsUnredactedSensitiveText(redacted), false, 'redacted JSON must contain no sensitive fixture text');

98assert.equal(redactJson({ source_refs: [{ file_generation: 'active', seq: 1, checksum: 'a'.repeat(64) }], file_path: '/home/example/private-file' }).source_refs[0].file_generation, 'active', 'source ref file_generation is audit evidence, not a filesystem path');

99assert.equal(containsUnredactedSensitiveText(redactText(JSON.stringify(sensitive))), false, 'redacted text must contain no sensitive fixture text');

100assert.equal(containsUnredactedSensitiveText('api_key=abcdefghijklmnopqrstuvwxyz'), true);

101assert.equal(containsUnredactedSensitiveText('api_key="abcdefghijklmnopqrstuvwxyz"'), true);

102assert.equal(containsUnredactedSensitiveText(redactText('api_key="abcdefghijklmnopqrstuvwxyz"')), false);

103assert.equal(containsUnredactedSensitiveText(redactText('api_key=abcdefghijklmnopqrstuvwxyz')), false);

104assert.equal(containsUnredactedSensitiveText('aaaabbbbccccddddeeeeffff.gggghhhhiiiijjjjkkkkllll.mmmmnnnnooooppppqqqqrrrr'), true);

105assert.equal(containsUnredactedSensitiveText(redactText('-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----')), false);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L105

Critical

Secret Pattern

RSA private key in scripts/test-agent-experience-phase2-storage.mjs

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L105

106assert.equal(containsUnredactedSensitiveText('/tmp/pi-secret-file'), true);

107assert.equal(containsUnredactedSensitiveText('/media/misunderstood/DATA/private'), true);

108assert.equal(containsUnredactedSensitiveText(redactText('/media/misunderstood/DATA/private')), false);

109assert.equal(sensitive.email, 'phase2@example.invalid', 'redactJson must not mutate caller input');

110

111const a = { b: 2, a: { z: 9, c: 3 } };

112const b = { a: { c: 3, z: 9 }, b: 2 };

113assert.equal(canonicalJson(a), canonicalJson(b));

114assert.equal(checksumJson(a), checksumJson(b));

115assert.notEqual(checksumJson(a), checksumJson({ ...a, b: 3 }));

116

117await assert.rejects(() => initExperienceStorage(root, { allowInit: false }), /allowInit=true/);

118const storage = await initExperienceStorage(root, { allowInit: true, userId: 'user-a' });

119let backup;

120try {

121 assert.equal(storage.userId, 'user-a');

122 const hotPathStorage = await openExistingExperienceStorage(root, { userId: 'user-a' });

123 assert.equal(hotPathStorage.userId, 'user-a');

124 hotPathStorage.db.close();

125 assert.equal(await privateStatMode(storage.dbPath), 0o600, 'sqlite db must be 0600');

dist/experience-consolidate.mjsView file

Lines 1456-1496javascript

1456 const info = await lstat4(path);

1457 if (info.isSymbolicLink()) throw new Error(`Refusing symlinked Agent Experience path: ${path}`);

1458 if (info.isFile()) return "file";

scripts/test-steering-tui-smoke.pyView file

•path = scripts/test-steering-tui-smoke.py kind = build_helper sizeBytes = 4986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-steering-tui-smoke.pyView on unpkg

Source & flagged code

4 flagged · loading source

scripts/test-agent-experience-phase2-storage.mjsView file

105patternName = private_key_rsa severity = critical line = 105 matchedText = assert.e...se);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L105

105patternName = private_key_rsa severity = critical line = 105 matchedText = assert.e...se);

Critical

Secret Pattern

RSA private key in scripts/test-agent-experience-phase2-storage.mjs

scripts/test-agent-experience-phase2-storage.mjsView on unpkg · L105

dist/experience-consolidate.mjsView file

1476async function loadSqliteRuntime() { L1477: const sqlite = await import("node:sqlite"); L1478: if (typeof sqlite.DatabaseSync !== "function" || typeof sqlite.backup !== "function") throw new Error("Agent Experience SQLite backup API unavailable");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/experience-consolidate.mjsView on unpkg · L1476

scripts/test-steering-tui-smoke.pyView file

•path = scripts/test-steering-tui-smoke.py kind = build_helper sizeBytes = 4986 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/test-steering-tui-smoke.pyView on unpkg

Findings

2 Critical6 Medium5 Low

CriticalCritical Secretscripts/test-agent-experience-phase2-storage.mjs

CriticalSecret Patternscripts/test-agent-experience-phase2-storage.mjs

MediumDynamic Requiredist/experience-consolidate.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/test-steering-tui-smoke.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings