pi-orchestrator-config@4.10.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe Git helper executes dynamically assembled shell commands and interpolates branch values into those commands, leaving a conditional command-injection risk. The manifest has no install lifecycle hook, and the source does not establish an unconditional attack chain, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A Git workflow calls the helper with a crafted branch name.
Impact
A crafted branch name may cause commands to run with the package user's privileges.
Mechanism
Arguments are joined into a shell command, and branch values are interpolated into shell command strings.
AI rationale
The Git helper executes dynamically assembled shell commands and interpolates branch values into those commands, leaving a conditional command-injection risk. The manifest has no install lifecycle hook, and the source does not establish an unconditional attack chain, so this warrants a warning rather than a block.
Evidence
extensions/orchestrator/git-helpers.ts
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Git helper assembles a shell command from arguments and runs it with execSync.
- Branch values are interpolated into shell commands, creating a conditional command-injection risk when processing a crafted branch name.
- The manifest defines build and prepack scripts, with no install lifecycle hook.
Evidence against
- The identified risk depends on crafted branch data reaching the Git helper; the inspected source does not establish an unconditional attack chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.10.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.