pi-history-ingest
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted session logs from the Pi coding agent, which could contain malicious instructions designed to influence the agent during ingestion.
- Ingestion points: Reads JSONL session data from the path defined by
PI_HISTORY_PATH(defaults to~/.pi/agent/sessions/). - Boundary markers: The instructions mandate a distillation process into thematic clusters and require the use of explicit source reference comments (
<!-- source: pi:... -->) rather than verbatim transcription. - Capability inventory: Uses
findfor file discovery,obsidian-wikifor metadata synchronization, andqmdfor search indexing; performs local file writes to the Obsidian vault. - Sanitization: Includes a 'Critical privacy filter' that explicitly directs the agent to remove API keys, tokens, passwords, and redact private identifiers before storage.
- [COMMAND_EXECUTION]: The skill utilizes several local command-line tools to manage the ingestion pipeline.
- Executes
findto inventory session files and calculate deltas. - Executes
obsidian-wiki memory syncto update vault logs and indices. - Executes
qmd updateandqmd embedto refresh the search index after vault writes.
Audit Metadata