pi-extension-sync
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and installs the
@earendil-works/pi-coding-agentpackage and its related components from the npm registry using commands likenpm packandnpm install. - [COMMAND_EXECUTION]: The skill executes several shell commands to manage the environment and verify the code, including
npm,tsc,mise, and repository-specific test scripts. It also navigates local system paths associated with themiseruntime manager (e.g.,~/.local/share/mise/installs/) to locate SDK installations. - [DYNAMIC_EXECUTION]: The skill instructs the agent to create a temporary
tsconfig.jsonfile at runtime. This configuration is used to dynamically map imports to the downloaded SDK files for typechecking. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, specifically
CHANGELOG.mdand API documentation from the target SDK, to guide its code modification tasks. This creates a surface for indirect prompt injection attacks. - Ingestion points:
CHANGELOG.md, official SDK documentation, and API references from the remote package. - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the external documentation.
- Capability inventory: The agent has the ability to write files (applying fixes), execute shell commands (
npm,tsc), and run the repository's test suite. - Sanitization: The instructions do not include steps to sanitize or validate the content retrieved from the changelogs or documentation before processing it.
Audit Metadata