pi-orchestrator-config@4.14.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe dashboard’s default network exposure allows unauthenticated private-network clients to view session content and submit prompts, leaving a concrete agent-control risk. The package has no install lifecycle hook, so this supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting a Pi session while pidash is enabled, which is the default.
Impact
A reachable network client may read session content and send prompts to the active agent.
Mechanism
The extension connects to the local daemon and forwards session history. The daemon listens on all interfaces; its WebSocket origin check permits requests without an Origin header, and browser messages can submit prompts to the session.
AI rationale
The dashboard’s default network exposure allows unauthenticated private-network clients to view session content and submit prompts, leaving a concrete agent-control risk. The package has no install lifecycle hook, so this supports a warning rather than a block.
Evidence
extensions/orchestrator/project-settings.tsextensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.ts
Network endpoints2
0.0.0.0:19190 (/ws/pi, /ws/browser)ws://127.0.0.1:${pidashPort}/ws/pi
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Pidash is enabled by default and the extension connects during normal session startup.
- The dashboard server listens on all network interfaces and permits private-network origins.
- The WebSocket origin check only rejects a disallowed origin when an Origin header is present.
- The extension sends session history, including message content, to the dashboard daemon.
- Dashboard messages can submit prompts to the active Pi session.
Evidence against
- The manifest defines prepack and UI-build scripts, with no install lifecycle hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.14.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.