pi-extension-sync

Warn

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches and installs the @earendil-works/pi-coding-agent package and its related components from the npm registry using commands like npm pack and npm install.
  • [COMMAND_EXECUTION]: The skill executes several shell commands to manage the environment and verify the code, including npm, tsc, mise, and repository-specific test scripts. It also navigates local system paths associated with the mise runtime manager (e.g., ~/.local/share/mise/installs/) to locate SDK installations.
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to create a temporary tsconfig.json file at runtime. This configuration is used to dynamically map imports to the downloaded SDK files for typechecking.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, specifically CHANGELOG.md and API documentation from the target SDK, to guide its code modification tasks. This creates a surface for indirect prompt injection attacks.
  • Ingestion points: CHANGELOG.md, official SDK documentation, and API references from the remote package.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the external documentation.
  • Capability inventory: The agent has the ability to write files (applying fixes), execute shell commands (npm, tsc), and run the repository's test suite.
  • Sanitization: The instructions do not include steps to sanitize or validate the content retrieved from the changelogs or documentation before processing it.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 1, 2026, 10:07 AM