pi-transcript
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests and processes untrusted conversational data from pi.dev session files.
- Ingestion points: The script
scripts/extract_session.pyreads JSONL-formatted session logs from the user's home directory (~/.pi/agent/sessions). - Boundary markers: Output is structured as JSON or uses text role markers (e.g.,
=== USER ===), but the skill lacks explicit 'ignore embedded instructions' warnings for the agents that consume its output. - Capability inventory: The script is limited to local file system read access and writing to standard output; it does not perform network operations or execute arbitrary system commands in its core logic.
- Sanitization: No sanitization, escaping, or instruction-filtering is applied to the extracted text content before it is presented to the agent.
Audit Metadata