pi-orchestrator-config@4.22.1
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe dashboard is an intended package feature, but it starts by default and exposes session viewing and prompt submission over an unauthenticated LAN-accessible WebSocket. This creates a real access-control risk, though the reviewed source does not show publisher-directed data theft or another clear attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Loading the extension and starting a Pi TUI session with pidash enabled, which is the default.
Impact
Other clients on the local network may be able to read session history and submit prompts to active Pi sessions.
Mechanism
The extension starts and connects to a daemon listening on 0.0.0.0; browser WebSocket access is gated by Origin matching but not authentication. The extension forwards session history, and browser prompts are relayed to Pi.
AI rationale
The dashboard is an intended package feature, but it starts by default and exposes session viewing and prompt submission over an unauthenticated LAN-accessible WebSocket. This creates a real access-control risk, though the reviewed source does not show publisher-directed data theft or another clear attack.
Evidence
settings-keys.jsonextensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.ts
Network endpoints2
0.0.0.0:19190 HTTP / and WebSocket /ws/browser127.0.0.1:19190 WebSocket /ws/pi
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Pidash is enabled by default in the package settings.
- On a Pi session start, the extension connects to pidash automatically when a live TUI context is available.
- The pidash server listens on 0.0.0.0 and accepts browser connections from localhost and private LAN origins.
- The browser WebSocket upgrade checks Origin but has no authentication check before accepting the connection.
- The extension loads session history and forwards it to the daemon; the browser can also send prompts that the daemon forwards into a Pi session.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; its scripts are build and typecheck tasks.
- The dashboard and session forwarding are documented features of the package, and the server is intended for local and LAN access.
- Image generation sends the user-requested prompt and Gemini API key to Google's Gemini API, its stated service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/git-helpers.tsView file
440*
L441: * Quoted text is not automatically inert — `bash -c 'git add x'`,
L442: * `eval '...'` and `"$(git add x)"` all execute — and a heredoc body is inert
High
Shell
Package source references shell execution.
extensions/orchestrator/git-helpers.tsView on unpkg · L440extensions/acpx-provider/load-runtime.tsView file
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/git-helpers.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.22.1.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.22.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.