pi-orchestrator-config@4.21.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s default pidash setup exposes session history and agent controls on a LAN-reachable daemon without authenticating browser clients. This is a serious capability and access-control risk, but the dashboard purpose and LAN origin restriction do not establish malicious intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An interactive pi session starts with pidash enabled, which is the default absent an explicit `pidash_enable` setting.
Impact
A client on an allowed reachable network may read session content and send commands to connected agent sessions. This is a meaningful agent-control and confidentiality risk, though it is not evidence of malicious intent.
Mechanism
The extension starts a daemon bound to `0.0.0.0`; browser WebSocket clients can watch registered sessions and send commands that are forwarded to pi sessions. The origin allowlist restricts browser origins to localhost/private LAN ranges but does not authenticate clients.
AI rationale
The package’s default pidash setup exposes session history and agent controls on a LAN-reachable daemon without authenticating browser clients. This is a serious capability and access-control risk, but the dashboard purpose and LAN origin restriction do not establish malicious intent.
Evidence
extensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.ts
Network endpoints2
0.0.0.0:19190generativelanguage.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Pidash is enabled by default when no `pidash_enable` setting is present; only an explicit false setting disables registration.
- The pidash daemon listens on `0.0.0.0` and accepts browser origins from private LAN address ranges.
- Browser WebSocket clients can watch sessions, and the daemon forwards pidash commands to connected pi sessions without an authentication check in the inspected handlers.
- Pidash registers session metadata and replays session history to the daemon; live event payloads can include message content.
- The image-generation tool sends its configured Gemini key to Google's Generative Language API when the user invokes the tool.
Evidence against
- Pidash is documented as a dashboard for aggregating and interacting with pi sessions, and its daemon uses a private/LAN origin allowlist.
- Pidash skips registration for one-shot sessions, and its setting can disable the feature.
- The image-generation key is sent to the Google API endpoint that provides the requested image-generation service.
- No malicious install hook or unrelated credential destination was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
47if (existsSync(runtimeJs)) {
L48: return (await import(pathToFileURL(runtimeJs).href)) as AcpxRuntimeModule;
L49: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
extensions/acpx-provider/load-runtime.tsView on unpkg · L47scripts/serve-ui.tsView file
78opts.log(`dist/ missing, building ${opts.name}...`);
L79: execSync("npm install --production=false && npm run build", {
L80: cwd: uiSrcDir,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/serve-ui.tsView on unpkg · L78scripts/build-extension-uis.shView file
•path = scripts/build-extension-uis.sh
kind = build_helper
sizeBytes = 669
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/build-extension-uis.shView on unpkgextensions/image-gen/image-gen.ts#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
extensions/image-gen/image-gen.ts#virtual:normalized:round1View on unpkgextensions/pidash/pidash.tsView file
•matchType = previous_version_dangerous_delta
matchedPackage = pi-orchestrator-config@4.17.1
matchedIdentity = npm:cGktb3JjaGVzdHJhdG9yLWNvbmZpZw:4.17.1
similarity = 0.900
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
extensions/pidash/pidash.tsView on unpkgFindings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.21.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.