add-provider-models-to-pi

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like jq, pi, and rm for valid configuration tasks such as validating JSON integrity, listing models, and cleaning up temporary log files.
  • [COMMAND_EXECUTION]: The skill executes a debugging script (capture.ts) via the pi --extension flag. This is used for the legitimate purpose of capturing outgoing request payloads and incoming response metadata to debug model configuration issues.
  • [DATA_EXPOSURE]: The skill accesses /home/cnife/.pi/agent/models.json which is the expected configuration path for the user's agent environment.
  • [SAFE]: Network activities are restricted to capturing local traffic for debugging purposes and logging it to /tmp/pi-verify-<provider>.log. The logs are documented to potentially contain sensitive data (system prompts, messages), but they are kept locally on the user's machine and the skill instructs the user to delete them after debugging.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 07:26 AM
Security Audit — agent-trust-hub — add-provider-models-to-pi