pi-agent-harness

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository documentation exposes an extension/plugin system that loads and executes user/package-provided TypeScript extensions with hooks that can modify outbound provider requests and payloads and register providers/tools — capabilities that can be trivially abused for credential theft, covert data exfiltration and supply‑chain backdoors if a malicious extension or package is installed.