registry / pi-orchestrator-config / 4.5.0
pi-orchestrator-config@4.5.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no install-time attack, but the default-enabled dashboard exposes session viewing and prompt submission on a network-wide listener without authentication in the inspected WebSocket path. This is an unresolved capability risk, so warn rather than block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A TUI session starts while pidash is enabled, which is the default; the extension connects to or starts the daemon.
Impact
A reachable local-network client could view session activity and send prompts into the agent session.
Mechanism
The extension forwards session events to the daemon, which serves browser WebSocket clients. A browser client can watch buffered session events and submit prompts to a connected Pi session.
AI rationale
Source inspection found no install-time attack, but the default-enabled dashboard exposes session viewing and prompt submission on a network-wide listener without authentication in the inspected WebSocket path. This is an unresolved capability risk, so warn rather than block.
Evidence
extensions/pidash/pidash.tsscripts/pidash-server.tsscripts/daemon-shared.tssettings-keys.json
Network endpoints3
0.0.0.0/ws/browserws://127.0.0.1:${pidashPort}/ws/pi
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Pidash is enabled by default and connects during a TUI session start.
- Pidash forwards Pi events to its daemon, including agent and message events.
- The daemon listens on all interfaces and permits WebSocket upgrades when the Origin header is absent; browser clients can watch sessions and receive buffered events.
- Browser messages can be forwarded as prompts to a connected Pi session.
Evidence against
- Pidash is a package feature intended to provide a browser dashboard; the source restricts supplied Origin headers to localhost or private-network addresses.
- The Pi extension connects to the daemon over loopback, and no credential theft or unrelated publisher-controlled recipient was found in the inspected path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/session-validation.tsView file
206" • macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n" +
L207: " • Windows: powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n" +
L208: " • Docs: https://docs.astral.sh/uv/",
High
Shell
Package source references shell execution.
extensions/orchestrator/session-validation.tsView on unpkg · L206extensions/acpx-provider/load-runtime.ts
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/session-validation.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.5.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.