pi-agent
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation describes an installation method for the Pi CLI that involves piping a remote shell script directly into a shell interpreter (
curl -fsSL https://pi.dev/install.sh | sh). This is a high-risk pattern that executes unverified remote code. - [COMMAND_EXECUTION]: The tool documented in this skill provides a
bashexecution tool and a!commandsyntax that allows the AI agent to run arbitrary shell commands with the user's permissions. The documentation explicitly notes that Pi is not sandboxed by default. - [PROMPT_INJECTION]: The skill describes functionality for fetching content from URLs, YouTube transcripts, and PDFs. This creates an indirect prompt injection surface where malicious instructions in external data could bypass intent and control the agent's actions.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing extensions and packages from npm and GitHub (e.g.,
pi install npm:pi-subagents), which involves downloading and running third-party code with the permissions of the Pi process. - [DATA_EXFILTRATION]: The skill documents how the tool accesses and stores sensitive information, such as API keys and session tokens, in
~/.pi/agent/auth.jsonand environment variables. Given the agent's broad shell and network access, these credentials represent a target for potential exfiltration if the agent is compromised via prompt injection.
Audit Metadata