registry / pi-orchestrator-config / 4.6.0
pi-orchestrator-config@4.6.0
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged runtime calls are tied to a user-facing feature, a fixed session check, or a missing-UI build fallback. The inspected network destinations and activation paths do not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes image generation, starts a session with the extension enabled, or requests a UI route when built assets are missing.
Impact
These inspected behaviors do not establish credential theft, unauthorized account actions, or unconsented changes to consumer configuration.
Mechanism
The image tool sends its request to Gemini; pidash connects to a loopback daemon; the UI fallback installs and builds its UI dependencies only when needed.
AI rationale
The manifest has no install hook, and the flagged runtime calls are tied to a user-facing feature, a fixed session check, or a missing-UI build fallback. The inspected network destinations and activation paths do not establish a concrete attack.
Evidence
package.jsonextensions/image-gen/image-gen.tsextensions/orchestrator/session-validation.tsscripts/serve-ui.tsextensions/pidash/pidash.ts
Network endpoints2
generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContentws://127.0.0.1:${pidashPort}/ws/pi
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only UI build and prepack scripts; it has no install lifecycle hook.
- Image generation is exposed as a named tool and sends its request with an API key to Google's Gemini API.
- At session start, session validation checks for the fixed `uv` command.
- The UI build fallback runs only when the UI output is missing and its source directory contains a package manifest.
- Pidash connects to a loopback WebSocket daemon and registers session metadata there.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/session-validation.tsView file
206" • macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n" +
L207: " • Windows: powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n" +
L208: " • Docs: https://docs.astral.sh/uv/",
High
Shell
Package source references shell execution.
extensions/orchestrator/session-validation.tsView on unpkg · L206extensions/acpx-provider/load-runtime.ts
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/session-validation.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.6.0.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.