pi-coding-agent
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the
pi installcommand, which allows the installation of extensions and packages from NPM registries and Git repositories. - [REMOTE_CODE_EXECUTION]: Instructions describe how to execute remote code via the
pi -eflag and persistent plugin installations. The skill correctly identifies this as a security risk, including a warning that extensions run with full system permissions and should only be installed from trusted sources. - [DYNAMIC_EXECUTION]: The documentation covers the tool's use of runtime TypeScript loading (via the jiti library) to execute extension code without a prior compilation step. It also details the registration of custom tools and lifecycle event handlers that can perform arbitrary operations.
Audit Metadata