The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes an external CLI tool named pi via the bash tool. This tool is not a standard utility and its behavior is defined by the skill's instructions.
[REMOTE_CODE_EXECUTION]: The pi tool is explicitly granted bash and read capabilities via command-line flags (--tools read,bash). This allows a sub-agent to execute arbitrary commands on the host system based on instructions it receives.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the repository (code changes, local instructions) and processes it through a sub-agent with active shell access.
Ingestion points: Files within the repository, staged changes, and commit history.
Boundary markers: No delimiters or safety instructions are used to separate untrusted repository content from the sub-agent's system prompt.
Capability inventory: The sub-agent has full access to the bash and read tools as specified in the pi command invocation.
Sanitization: No filtering or sanitization is applied to the repository content before it is processed.
[PROMPT_INJECTION]: User-supplied 'scope' strings are appended directly to the command prompt without escaping or validation, providing a direct injection vector into the pi tool's instructions.
[REMOTE_CODE_EXECUTION]: The use of a fictitious model identifier (openai-codex/gpt-5.6-sol) is highly suspicious and suggests the potential for a malicious binary to be executed under the guise of an AI model invocation.

pi-code-review