pi-agent
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents how to install the Pi CLI using a remote shell script (curl -fsSL https://pi.dev/install.sh | sh). This is a standard installation method for the documented tool.
- [COMMAND_EXECUTION]: The Pi Agent supports executing shell commands via the !command prefix and using shell commands in configuration files (models.json) to dynamically resolve secrets or API keys.
- [REMOTE_CODE_EXECUTION]: The skill explains how to load TypeScript extensions and install packages from NPM or Git, which involves executing code from local or remote repositories.
- [PROMPT_INJECTION]: The pi-web-access package enables the agent to fetch content from external URLs, GitHub repositories, and YouTube videos. This represents a potential surface for indirect prompt injection. 1. Ingestion points: The web_search and fetch_content tools process untrusted data from the web. 2. Boundary markers: Documentation warns that Pi is not sandboxed by default and recommends using Docker or VMs for untrusted repositories. 3. Capability inventory: The agent has access to bash, read, write, and edit tools. 4. Sanitization: Specific sanitization methods for fetched content are not detailed in the references.
- [SAFE]: The skill follows security best practices by recommending the use of environment variables or dedicated authentication files (auth.json) for managing API keys rather than hardcoding them.
Audit Metadata