pi-extension-creator
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a development kit for Pi extensions. The instructions, templates, and scripts are designed to facilitate legitimate software development.
- [COMMAND_EXECUTION]: The skill provides examples of extensions that interact with the shell (e.g.,
permission-gate.ts,policy.ts). However, these examples specifically include logic to detect and block potentially harmful commands, demonstrating best-practice security implementations. - [REMOTE_CODE_EXECUTION]: While the documentation mentions package installation via
npmorpi install, it correctly advises the use of--ignore-scriptsduring development and lacks any references to untrusted or malicious remote sources. - [INDIRECT_PROMPT_INJECTION]: The skill correctly addresses the risk of indirect injection by providing patterns for 'Safety Gates' (in
references/patterns-and-examples.md) and advising developers to use structured data validation and human-in-the-loop confirmations for risky operations.
Audit Metadata