add-provider-models-to-pi
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
jq,pi, andrmfor valid configuration tasks such as validating JSON integrity, listing models, and cleaning up temporary log files. - [COMMAND_EXECUTION]: The skill executes a debugging script (
capture.ts) via thepi --extensionflag. This is used for the legitimate purpose of capturing outgoing request payloads and incoming response metadata to debug model configuration issues. - [DATA_EXPOSURE]: The skill accesses
/home/cnife/.pi/agent/models.jsonwhich is the expected configuration path for the user's agent environment. - [SAFE]: Network activities are restricted to capturing local traffic for debugging purposes and logging it to
/tmp/pi-verify-<provider>.log. The logs are documented to potentially contain sensitive data (system prompts, messages), but they are kept locally on the user's machine and the skill instructs the user to delete them after debugging.
Audit Metadata