The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to access and read ~/.pi/agent/auth.json, which is explicitly described as containing provider credentials. Accessing files that store API keys or tokens exposes sensitive authentication data to the agent's context.
[DATA_EXFILTRATION]: The agent is directed to read and modify critical configuration files located at ~/.pi/agent/settings.json and ~/.pi/agent/models.json to register custom models and change default settings.
[COMMAND_EXECUTION]: The skill involves running local shell commands using the pi CLI, such as pi --list-models and smoke tests using pi --provider to verify the new configurations.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by instructing the agent to ingest and process untrusted data from local configuration files while possessing file-write and command-execution capabilities.
Ingestion points: Local configuration files including ~/.pi/agent/settings.json, ~/.pi/agent/models.json, and ~/.pi/agent/auth.json (SKILL.md).
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are provided for the content read from these files.
Capability inventory: The skill possesses file system write access (to configuration files) and the ability to execute local shell commands via the pi CLI (SKILL.md).
Sanitization: No input validation or sanitization steps are defined for the data retrieved from the configuration files before it is used by the agent.

pi-custom-model