registry / pi-fairy-tales / 0.10.0

pi-fairy-tales@0.10.0

Fairy-Tales-class harness for pi: subagents, memory, plan mode, ultraplan, hooks, todos, smart compaction, status line, web fetch, artifacts

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No unconsented install-time execution is present. The shipped setup script can install this first-party pi extension and create local launchers only when the user explicitly runs it; runtime web access is a user-invoked fetch tool with private-host blocking.

Static reason

No blocking static signals were detected.

Trigger

User manually runs `install.sh`, invokes pi extension commands/tools, or calls the registered `fetch` tool.

Impact

Can modify the user's pi configuration or local launcher paths after explicit use; no confirmed autonomous payload or exfiltration chain.

Mechanism

First-party pi extension setup, local launcher creation, and user-directed agent/web tooling.

Rationale

Source inspection supports a legitimate pi extension with explicit setup and broad agent tooling, not malicious behavior. Per the lifecycle policy, its explicit first-party extension setup warrants a warn rather than a block.

Evidence

package.jsoninstall.shextensions/fairy-tales-web.tssrc/net.tssrc/config.tssrc/ultraplan/worktree.tsextensions/fairy-tales-artifact.tssrc/subagent/engine.ts$HOME/bin/ftales$HOME/Applications/ftales.app$HOME/.pi/agent/fairy-tales.json<cwd>/artifacts/<cwd>/.pi/fairy-tales.json

pi-fairy-tales@0.10.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code