registry / pi-quiver / 3.2.0

pi-quiver@3.2.0

Personal pack of Pi coding-agent extensions: context-safe fetch, doc_to_md PDF/DOCX/PPTX-to-Markdown conversion, session naming, and a themed ASCII startup header.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is a Pi agent-extension package with explicit web-fetch, document-conversion, session naming, and optional provider-request features. No unconsented install-time mutation or confirmed malicious chain was found.

Static reason

No blocking static signals were detected.

Trigger

Pi loads the declared extensions; network/process actions require a fetch/doc_to_md call or enabling the relevant feature.

Impact

Can retrieve user-specified URLs, process supplied local documents, and alter qualifying Anthropic requests when enabled.

Mechanism

User-invoked agent tools plus opt-in provider request hooks

Rationale

No concrete malicious behavior was found. It warrants a warning only because it is a host-loaded AI-agent extension with network, subprocess, and provider-request capabilities.

Evidence

package.jsonfetch.tsdoc_to_md.tsfast-mode.tssession-name.tsextension-config.tsscripts/pdf_to_md.py

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence with false-positive risk.

pi-quiver@3.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code