pi-coding-agent-extensions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path shown in extensions/cross-agent.ts loads outsider-authored free text from local directories (.claude/skills/*.md, .gemini/skills/*.md, .codex/skills/*.md and .*/agents/*.md) via readFileSync(...) and injects it into the agent LLM context using app.addContextDocument(...) / app.session.systemPrompt.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The prereqs/install steps explicitly fetch and run remote code — e.g., curl -fsSL https://bun.sh/install | bash (executes a remote install script) and git clone https://github.com/disler/pi-vs-claude-code.git (pulls code that is required and subsequently executed/used) — so these are runtime external dependencies that execute remote code.