The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in references/overview.md recommends installing the Pi CLI via a pipe to bash command (curl -fsSL https://pi.dev/install.sh | sh) from an untrusted domain (pi.dev). This pattern is a critical security risk as it executes unverified remote scripts with local user permissions.
[DYNAMIC_CONTEXT_INJECTION]: The skill describes a !command syntax supported in models.json, auth.json, and MCP configuration files. This feature triggers immediate shell command execution whenever the configuration value (such as an API key or header) is resolved. This provides a mechanism for silent code execution if these configuration files are influenced by malicious repository content or extensions.
[DYNAMIC_EXECUTION]: The tool supports the execution of arbitrary JavaScript code through workflowScript in the pi-subagents package and mcpScript in the pi-mcp-adapter package. It also dynamically loads and executes TypeScript extensions using jiti. This creates a high risk of executing malicious code generated by an LLM or provided through untrusted project resources.
[INDIRECT_PROMPT_INJECTION]: As explicitly acknowledged in references/security.md, the agent harness is designed to ingest and process data from untrusted sources such as external repositories and web content. Combined with the agent's ability to execute shell commands and modify files, this creates a vast attack surface for indirect prompt injection where hidden instructions in code or documentation could take control of the agent.
[DATA_EXFILTRATION]: The pi-web-access extension can extract browser cookies from local databases for authentication. If an agent is manipulated into exfiltrating these cookies, it results in a total compromise of the user's web sessions. Furthermore, the curator utility runs a web server that transmits sensitive session tokens over unencrypted HTTP, making it vulnerable to interception when accessed remotely.
[COMMAND_EXECUTION]: The skill documentation provides various ways for the agent to execute shell commands, including the bash tool and the !command prefix in interactive mode. While these are core features, their combination with untrusted input sources presents a significant risk to the host system.

pi-agent