registry / pi-multica-spine / 0.1.3

pi-multica-spine@0.1.3

Pi extension that keeps Multica work agents bound to issue, PR, evidence, and handoff contracts.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A Pi extension activates in agent sessions, modifies the system prompt, and wraps agent-issued git push/fetch/pull/ls-remote commands with a timeout guard. It persists only workflow metadata under the active project directory; no concrete malicious chain was found.

Static reason

No blocking static signals were detected.

Trigger

Pi loads the declared extension; session start, agent start, or an agent-issued matching git command.

Impact

Can influence Pi-agent workflow and execute the already agent-supplied git network command with local permissions; no unconsented data exfiltration or destructive action is established.

Mechanism

Agent prompt injection, git command wrapping, and repo-local state storage.

Rationale

The package is not malicious by source evidence, but its automatic Pi lifecycle hooks and shell-backed command wrapper create a meaningful agent-extension risk that warrants a warning under policy.

Evidence

package.jsonextensions/index.tslib/state-store.tslib/git-network-guard.tsREADME.md.multica-spine/current.json.multica-spine/tasks/<safe-issue-identifier>.jsonlib/git-network-guard-cli.mjs

Decision evidence

public snapshot

pi-multica-spine@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code