pi-agent

This fragment is configuration/model-provider documentation rather than executable malicious code. However, it explicitly describes a highly sensitive capability: configuration values in apiKey/headers can support request-time shell command execution and environment-variable interpolation, and those resolved values directly influence outbound Authorization/headers and thus can enable credential/secret exfiltration or attacker-driven data access if ~/.pi/agent/models.json integrity is compromised or users are tricked into using a malicious configuration. Additional risk stems from verbatim samplingParams merging and configurable baseUrl/routing that can redirect requests to attacker-controlled proxies.

Overall, the fragment primarily documents multi-provider credential resolution and authentication. The key security concern is an explicitly described mechanism where a credential string beginning with '!' is executed as a system command and its stdout is used as the resolved credential (cached for the process lifetime). This is a high-impact risk if an attacker can influence configuration/inputs (CLI args, auth.json, env vars, models.json, or secret-reference values), enabling command execution and/or credential compromise. No concrete malware payloads or network exfiltration logic are shown in the fragment itself, but the documented command-execution semantics materially elevate security risk.