@xaccefy/pi-xpi

XPI — offensive security tools for Pi Agent. Casefile tracking, web search, library docs, exploit technique search, and todo tracking.

Packages

Package details

skill

Install @xaccefy/pi-xpi from npm and Pi will load the resources declared by the package manifest.

npm repo home report

$ pi install npm:@xaccefy/pi-xpi

Package: @xaccefy/pi-xpi
Version: 0.8.1
Published: Aug 4, 2026
Downloads: 6,460/mo · 1,140/wk
Author: xaccefy
License: MIT
Types: skill
Size: 135.5 KB
Dependencies: 4 dependencies · 3 peers

Pi manifest JSON

{
  "skills": [
    "./skills"
  ],
  "subagents": {
    "agents": [
      "./agents"
    ]
  }
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

XPI

Security tooling for the Pi agent — casefile tracking, web search, exploit-technique intelligence, code search, and todos.

What it is

XPI turns the Pi agent into a security researcher: a case ledger with enforced gates, real exploit-technique grounding, web lookup, fast code search, and a pipeline that keeps findings honest.

Casefile — hypothesis → investigating → confirmed → reported, with gates at every step
Honest PoC gates — exit 0 + verification marker + control-target check (no fake confirms)
Exploit chains — ChainSuggest surfaces combinations the model missed
Coverage matrix — machine-checkable "we tested everything" claims
Code search — fff-powered grep/find, frecency-ranked

Install

./install.sh
# or
pi install npm:@xaccefy/pi-xpi

Set PREVIEW_IS_API_KEY for exploit_search (see docs/guide.md).

Quick start

/xp on     # enable the cyber workflow (subagent pipeline)
/xp lite   # single-agent variant

Full tool reference, configuration, and pipeline docs: docs/guide.md.

Packages

Package	npm
Umbrella	`@xaccefy/pi-xpi`
Case ledger	`@xaccefy/pi-casefile`
Web lookup + exploit search	`@xaccefy/pi-webxp`
Todos	`@xaccefy/pi-xtodo`

Develop

bun install
bun test --isolate
bun run typecheck