pi-extension-development
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and interpret project files like AGENTS.md and CLAUDE.md to guide the creation and auditing of extensions. Since these files are part of the target repository being processed, they could contain malicious instructions designed to hijack the agent's workflow.
- Ingestion points: Project-specific files including AGENTS.md, CLAUDE.md, and other project rule files in the target path.
- Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to ignore instructions embedded within these files.
- Capability inventory: The skill allows the agent to create files, execute shell commands (git, gh, pi, vp), and perform repository releases.
- Sanitization: Absent. There are no instructions to sanitize or validate the content of the ingested files before using them to drive the development process.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The development workflow involves installing extension packages directly from Git repositories.
- Evidence: The pi install git:github.com/OWNER/REPO command downloads and integrates external code. While this is a core platform feature, it involves remote code acquisition.
- Source: The instructions target GitHub, which is a well-known service.
- [COMMAND_EXECUTION]: The skill relies on executing system commands for git operations, package management, and release management.
- Evidence: Usage of git, gh, pi, and vp for repository management, linting, formatting, and releasing.
Audit Metadata