pi-cli-runtime

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly forwards raw user-provided arguments into a shell command (node ... task "") and preserves/returns stdout unchanged, which forces the LLM to include any secrets present in the arguments verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The pi:pi-rescue runtime workflow only invokes node "${CLAUDE_PLUGIN_ROOT}/scripts/pi-companion.mjs" task "<raw arguments>" and forwards the user’s (optionally route-flag-stripped) text directly to Pi, with no other reading of external/free-text sources by the required workflow.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.50). The skill explicitly defaults to "write-capable" runs and requires using task for explicit fixes (invoking a helper that can perform arbitrary changes), so it encourages making system changes though it does not directly instruct privilege escalation, editing of system files, or creating users.