registry / pi-orchestrator-config / 4.6.2
pi-orchestrator-config@4.6.2
Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source establishes a default-on local dashboard that forwards session content and can submit browser prompts, so a warning is appropriate. The inspected behavior is local and package-aligned, with no evidence of an external attack chain or install-time mutation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting a pi session while pidash is enabled, which is the default.
Impact
A local dashboard user can view forwarded session content and submit prompts to the active agent; no publisher-directed transfer was identified.
Mechanism
The extension starts a missing daemon, sends session history over a loopback WebSocket, and passes browser prompts to pi as follow-up messages.
AI rationale
The source establishes a default-on local dashboard that forwards session content and can submit browser prompts, so a warning is appropriate. The inspected behavior is local and package-aligned, with no evidence of an external attack chain or install-time mutation.
Evidence
extensions/pidash/pidash.tsscripts/daemon-shared.tssettings-keys.jsonscripts/serve-ui.ts
Network endpoints2
ws://127.0.0.1:${pidashPort}/ws/pilocalhost:${pidashPort}
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest lists build and prepack scripts and registers the package extension tree.
- The pidash dashboard is enabled by default; its registration returns early when disabled.
- A session start connects pidash and starts a missing daemon, using a loopback WebSocket.
- Pidash forwards saved user messages and accepts browser prompts as follow-up messages in the active session.
- The UI build command runs only when the UI files are missing.
Evidence against
- The inspected dashboard connection is local; no publisher-controlled recipient, credential collection, destructive behavior, or install-time settings mutation was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
7 flaggedextensions/image-gen/image-gen.tsView file
15import * as path from "node:path";
L16: import { execFileSync, spawn } from "node:child_process";
L17: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
extensions/image-gen/image-gen.tsView on unpkg · L15extensions/orchestrator/session-validation.tsView file
206" • macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh\n" +
L207: " • Windows: powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n" +
L208: " • Docs: https://docs.astral.sh/uv/",
High
Shell
Package source references shell execution.
extensions/orchestrator/session-validation.tsView on unpkg · L206extensions/acpx-provider/load-runtime.ts
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltaextensions/pidash/pidash.ts
HighChild Processextensions/image-gen/image-gen.ts
HighShellextensions/orchestrator/session-validation.ts
HighRuntime Package Installscripts/serve-ui.ts
HighSemantic Analysis Limitedextensions/image-gen/image-gen.ts#virtual:normalized:round1
MediumDynamic Requireextensions/acpx-provider/load-runtime.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/build-extension-uis.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to pi-orchestrator-config@4.6.2.
See all versions of pi-orchestrator-config for other recorded verdicts.
- Review the evidence and your use of pi-orchestrator-config@4.6.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.