The Agent Skills Directory

[COMMAND_EXECUTION]: The search.mjs script contains a resolveConfigValue function that uses execSync to run arbitrary shell commands. This execution is triggered if a credential or configuration value in the auth.json file starts with an exclamation mark (!). An attacker who can influence the content of this configuration file could achieve arbitrary command execution on the host machine.- [DYNAMIC_EXECUTION]: The skill uses dynamic import() calls to load modules from paths calculated at runtime. It searches through several locations including environment variables (PI_AI_MODULE_PATH, PI_AI_OAUTH_MODULE_PATH), current working directories, and parent directories. This behavior could lead to loading malicious code if these locations are writable by other processes or if the environment variables are manipulated.- [INDIRECT_PROMPT_INJECTION]: The skill exposes a significant surface for indirect prompt injection:
Ingestion points: User-provided search queries and purpose statements are interpolated directly into prompts. More critically, the skill performs a web search and feeds the results (untrusted external data) back into the LLM context.
Boundary markers: The prompt template lacks delimiters or specific instructions to the model to ignore malicious instructions embedded within the external search results.
Capability inventory: The script has the ability to read and write to the local filesystem (auth.json) and make outbound network calls to API providers.
Sanitization: There is no evidence of input validation or output sanitization to prevent injected instructions from being followed by the agent.- [CREDENTIALS_UNSAFE]: The script reads and writes sensitive authentication data, including API keys and OAuth tokens, in plaintext (or command-prefixed) format within the ~/.pi/agent/auth.json file.

native-web-search