pi-orchestrator-config@4.11.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiStatic inspection confirms a pathspec-to-shell command injection path, a serious vulnerability warranting a warning. Default-enabled pidash also exposes session data and agent input to reachable network clients; the inspected package has no install lifecycle hook, so these runtime risks do not establish an install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The Git risk is triggered when enforcement checks a git add pathspec. The pidash exposure starts with a TUI session while pidash is enabled, which is the default.
Impact
A crafted pathspec may execute shell commands as the Pi user. A network client able to reach pidash may view session data and submit prompts to the agent.
Mechanism
The Git helper joins arguments into an execSync shell command, including parsed pathspecs. Pidash binds to 0.0.0.0, accepts WebSocket requests with no Origin header, replays session events, and forwards browser prompts to Pi.
AI rationale
Static inspection confirms a pathspec-to-shell command injection path, a serious vulnerability warranting a warning. Default-enabled pidash also exposes session data and agent input to reachable network clients; the inspected package has no install lifecycle hook, so these runtime risks do not establish an install-time attack.
Evidence
extensions/orchestrator/git-helpers.tsextensions/orchestrator/enforcement.tsextensions/orchestrator/enforcement-helpers.tsextensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.tssettings-keys.json
Network endpoints1
0.0.0.0
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package registers its Pi extensions through package metadata; its npm scripts are for building and prepacking.
- The Git helper interpolates supplied arguments into a shell command.
- The Orchestrator passes parsed git add paths directly to that helper; its parser retains path tokens after `--`.
- Pidash is enabled by default and connects when a TUI session starts.
- The pidash daemon binds to all interfaces, and its WebSocket gate accepts requests without an Origin header.
- Pidash replays buffered session events to browser clients and forwards browser prompts into Pi.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
47if (existsSync(runtimeJs)) {
L48: return (await import(pathToFileURL(runtimeJs).href)) as AcpxRuntimeModule;
L49: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
extensions/acpx-provider/load-runtime.tsView on unpkg · L47scripts/serve-ui.tsView file
78opts.log(`dist/ missing, building ${opts.name}...`);
L79: execSync("npm install --production=false && npm run build", {
L80: cwd: uiSrcDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/serve-ui.tsView on unpkg · L78scripts/build-extension-uis.shView file
•path = scripts/build-extension-uis.sh
kind = build_helper
sizeBytes = 669
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/build-extension-uis.shView on unpkgextensions/image-gen/image-gen.ts#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
extensions/image-gen/image-gen.ts#virtual:normalized:round1View on unpkgextensions/pidash/pidash.tsView file
•matchType = previous_version_dangerous_delta
matchedPackage = pi-orchestrator-config@4.3.12
matchedIdentity = npm:cGktb3JjaGVzdHJhdG9yLWNvbmZpZw:4.3.12
similarity = 0.575
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
extensions/pidash/pidash.tsView on unpkgFindings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.11.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.