Pi Security Scanner

A security extension for pi-coding-agent that provides runtime protection and static analysis for your Pi agent environment.

Features

🛡️ Runtime Shield

• Bash Interceptor: Detects and blocks dangerous bash commands like curl, wget, nc, and unauthorized system modifications.
• File Access Monitor: Protects sensitive files like .env, .ssh/ keys, and .git/config from unauthorized writes or edits.
• /security-shield Command: Enables or disables the Runtime Shield. When disabled, no bash commands or file access are intercepted.

🔍 Static Scanner

• /security-scan Command: Scans all installed Pi extensions (globally and locally) for dangerous patterns such as eval(), child_process.exec(), and unauthorized network calls.

Security Check Documentation

For detailed information about all security checks, see docs/security-checks.md. This document explains:

• What patterns are flagged and why
• Severity levels (HIGH, MEDIUM, LOW)
• How to respond to different types of warnings
• What patterns are intentionally NOT flagged (to reduce false positives)

Installation

This extension is configured as a pi-package. You can install it by adding it to your Pi configuration:

pi install npm:pi-security-scanner

How it Works

The scanner leverages Pi's built-in Extension API:

• tool_call Event Hooks: Intercepts tool execution to provide real-time guardrails.
• Heuristic Engine: Uses regex-based analysis to identify suspicious code patterns in extension source files.
• User Confirmation: Never blocks silently—always asks for user permission before stopping a suspicious action.