pi-goal
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-provided objectives which are later interpolated into system prompts. It implements safety measures by XML-escaping the input (replacing &, <, and >) and wrapping the objective in
<objective>tags. The prompts explicitly instruct the AI to treat the objective as untrusted user data rather than system instructions, effectively mitigating potential injection attacks. - [DATA_EXFILTRATION]: Goal tracking state is persisted as JSON files within the agent's allocated extension directory (e.g.,
~/.pi/agent/extensions/pi-goal). This persistence is scoped to the local filesystem and is necessary for the skill's primary function of long-running goal management. No sensitive data access or external network exfiltration patterns were detected. - [COMMAND_EXECUTION]: The skill uses
spawnin a developer QA script (scripts/qa/drive.mjs) to execute the agent's own binary for end-to-end testing. However, the core runtime skill logic used by the agent does not invoke shell commands or execute arbitrary user-provided code. - [PROMPT_INJECTION]: An analysis of the indirect prompt injection surface (Category 8) confirms that while the skill ingests untrusted data from the user/agent context, it utilizes boundary markers, sanitization via escaping, and clear instructional guarding to prevent the model from obeying instructions embedded within processed data.
Audit Metadata