pi-orchestrator-config@4.3.10
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiPidash is a package-owned dashboard, but its automatic session connection exposes session data and prompt control to unauthenticated clients that can reach the all-interface listener. This is a dangerous runtime capability warranting a warning, not evidence of a publisher-directed attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A pi TUI session starts while the package extension is loaded.
Impact
A reachable client may read session activity and submit prompts to the agent; source inspection did not establish a publisher-controlled collector or intent to attack.
Mechanism
Pidash starts and connects to its daemon, which accepts browser WebSocket connections on all interfaces; watched session events are replayed and browser prompts are forwarded into the pi session.
AI rationale
Pidash is a package-owned dashboard, but its automatic session connection exposes session data and prompt control to unauthenticated clients that can reach the all-interface listener. This is a dangerous runtime capability warranting a warning, not evidence of a publisher-directed attack.
Evidence
extensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.ts
Network endpoints2
0.0.0.0:19190ws://127.0.0.1:<port>/ws/pi
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 90.0% confidence with medium false-positive risk.
Evidence for policy risk
- The package loads the extensions directory, whose pidash entrypoint registers the dashboard extension.
- A TUI session start connects pidash automatically; when the daemon is absent, the extension starts it and connects over loopback.
- The pidash daemon listens on all interfaces at default port 19190. Browser WebSocket clients are accepted without authentication when they omit an Origin header.
- The extension forwards session events over WebSocket; watched sessions replay buffered events, and browser prompt messages are forwarded into the pi session.
Evidence against
- This is a package-owned dashboard feature, and the pi client connects to its paired daemon over loopback. The source also restricts present WebSocket Origin headers to configured local and private network addresses.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/session-validation.tsView file
200" • macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n" +
L201: " • Windows: powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n" +
L202: " • Docs: https://docs.astral.sh/uv/",
High
Shell
Package source references shell execution.
extensions/orchestrator/session-validation.tsView on unpkg · L200extensions/shared/file-logger.ts
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/session-validation.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/shared/file-logger.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.3.10.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.