registry / pi-maestro-flow / 0.18.0

pi-maestro-flow@0.18.0

All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 252 file(s), 4.05 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.anysearch.com, api.exa.ai, api.openai.com, api.osv.dev, api.parallel.ai, api.perplexity.ai, api.search.brave.com, api.serpdive.com, api.tavily.com, app.tavily.com, brave.com, cdn.jsdelivr.net, chatgpt.com, cli.github.com, content-push.googleapis.com, dashscope.aliyuncs.com, example.com, fonts.googleapis.com, fonts.gstatic.com, gemini.google.com, generativelanguage.googleapis.com, github.com, img.youtube.com, json-schema.org, mcp.exa.ai, openrouter.ai, perplexity.ai, platform.parallel.ai, r.jina.ai, search.example.com, serpdive.com, services.nvd.nist.gov, www.cisa.gov, www.google.com, www.youtube.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-30json

2 "name": "pi-maestro-flow",

3 "version": "0.18.0",

4 "description": "All-in-one multi-agent orchestration for the Pi coding agent — parallel teammate dispatch, goals, plans, knowledge system, MCP/LSP/browser, and cockpit visualization in a single install",

5 "type": "module",

6 "engines": {

7 "node": ">=22.19.0"

8 },

9 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L9

10 "postinstall": "node scripts/configure-keybindings.mjs && node scripts/install-workflows.mjs && node scripts/register-companion-packages.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "prepack": "node scripts/prepare-package-skills.mjs && node ../../scripts/bundle-settings-core.mjs",

12 "postpack": "node ../../scripts/bundle-settings-core.mjs --clean && node scripts/prepare-package-skills.mjs --clean",

13 "test:install": "node --test test/configure-keybindings.test.mjs test/install-workflows.test.mjs test/register-companion-packages.test.mjs",

14 "test:package": "node scripts/verify-maestro-run-capabilities.mjs && node --experimental-transform-types --test test/prepare-package-skills.test.mjs test/package-resources.test.mjs test/package-resources-runtime.test.ts && node --test test/sdk-resolution-contract.test.mjs",

15 "test:conversion": "node --experimental-transform-types --test test/convert-pi.test.mjs test/maestro-run-capabilities.test.mjs test/skill-contract-lint.test.ts",

16 "check:maestro-run-cli": "node scripts/verify-maestro-run-capabilities.mjs",

17 "test:todo": "node --experimental-transform-types --test test/skill-loader.test.ts test/skill-manager.test.ts test/todo.test.ts test/todo-overlay.test.ts test/todo-cross-tool.test.ts test/cockpit-ownership.test.ts",

18 "test:compaction": "node --experimental-transform-types --test test/compaction.test.ts test/compaction-image.test.ts test/compaction-settings.test.ts test/compaction-tui.test.ts test/tool-result-spill.test.ts test/lossless.test.ts test/cache-gate.test.ts test/relevance.test.ts test/dedup.test.ts test/content-detector.test.ts",

19 "test:settings": "node --experimental-transform-types --test test/settings-provider.test.ts test/api-manager-settings-provider.test.ts test/mcp-settings-provider.test.ts test/skills-settings-provider.test.ts test/smart-search-settings-provider.test.ts test/settings-catalogs.test.ts test/tui-locale.test.ts",

20 "test:gui": "node --experimental-transform-types --test test/gui-server.test.ts test/gui-state.test.ts test/gui-events.test.ts test/gui-tools.test.ts test/gui-invoke.test.ts test/gui-e2e.test.ts",

21 "test:hooks": "node --experimental-transform-types --test test/hooks.test.ts",

22 "test:permissions": "node --experimental-transform-types --test test/permissions.test.ts test/ask.test.ts test/ask-sessionbar-integration.test.ts test/approval-mode.test.ts test/teammate-relay-ipc.test.ts test/direct-teammate-runtime.test.ts",

23 "test:providers": "node --experimental-transform-types --test test/api-provider-config.test.ts test/api-model-editor.test.ts test/explore-config-manager.test.ts test/cost-backfill.test.ts",

24 "test:mcp": "node --experimental-transform-types --test test/mcp-config.test.ts test/mcp-manager.test.ts test/mcp-server-manager.test.ts test/mcp-lifecycle-leases.test.ts test/mcp-ui-server.test.ts",

25 "test:goal": "node --experimental-transform-types --test test/goal.test.ts test/goal-verification-timeout.test.ts",

26 "test:bash-bg": "node --experimental-transform-types --test test/bash-bg.test.ts",

27 "test:plan": "node --experimental-transform-types --test test/plan-store.test.ts test/plan-editor.test.ts test/plan-lifecycle.test.ts test/plan-model.test.ts test/plan-todo-integration.test.ts test/statusline.test.ts",

28 "test:session": "node --experimental-transform-types --test test/session-bridge.test.ts test/session-export.test.ts test/todo-projection.test.ts test/workflow-coordinator.test.ts test/run-recovery.test.ts test/session-tui.test.ts test/ui-projection.test.ts test/skill-contract-lint.test.ts",

29 "test:swarm": "node --experimental-transform-types --test test/swarm-projection.test.ts test/swarm-tui.test.ts",

30 "test:packed": "node --test test/packed-consumer-e2e.test.mjs",

scripts/simulate-272k-stuck.mjsView file

Lines 4-44javascript

4 * 数据：dongdiankaifa9 / gpt-5.6-sol / 2026-07-31 真实会话（轨迹首个 nudge 穿越点

5 * 原始估算 134,521 ≈ 用户报告的 134,490

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView file

•path = optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.py kind = build_helper sizeBytes = 18004 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

optional/skills/scholar-thesis-docx/scripts/audit_docx_ooxml.pyView on unpkg

.pi/skills/team-swarm/scripts/test_aco.pyView file

•path = .pi/skills/team-swarm/scripts/test_aco.py kind = payload_in_excluded_dir sizeBytes = 18781 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/skills/team-swarm/scripts/test_aco.pyView on unpkg

src/extension/index.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-maestro-flow@0.19.0 matchedIdentity = npm:cGktbWFlc3Ryby1mbG93:0.19.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/extension/index.tsView on unpkg

pi-maestro-flow@0.18.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code