pi-history-ingest

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted session logs from the Pi coding agent, which could contain malicious instructions designed to influence the agent during ingestion.
  • Ingestion points: Reads JSONL session data from the path defined by PI_HISTORY_PATH (defaults to ~/.pi/agent/sessions/).
  • Boundary markers: The instructions mandate a distillation process into thematic clusters and require the use of explicit source reference comments (<!-- source: pi:... -->) rather than verbatim transcription.
  • Capability inventory: Uses find for file discovery, obsidian-wiki for metadata synchronization, and qmd for search indexing; performs local file writes to the Obsidian vault.
  • Sanitization: Includes a 'Critical privacy filter' that explicitly directs the agent to remove API keys, tokens, passwords, and redact private identifiers before storage.
  • [COMMAND_EXECUTION]: The skill utilizes several local command-line tools to manage the ingestion pipeline.
  • Executes find to inventory session files and calculate deltas.
  • Executes obsidian-wiki memory sync to update vault logs and indices.
  • Executes qmd update and qmd embed to refresh the search index after vault writes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 10:30 AM