pi-coding-agent

No clear evidence of intentional malware (no obfuscation or backdoor/persistence/execution behavior shown). However, the included example tool provides an unvalidated arbitrary filesystem read capability (fs.readFile with an attacker-influenced path) and directly feeds the resulting file contents back to the LLM (via toolResult forwarding). If tool invocation is reachable from untrusted prompts and if streaming/proxy/event pathways forward conversation context, this becomes a significant confidentiality risk (local file disclosure effectively built into the agent-tool interface).

No concrete malicious payload or explicit exfiltration destination is shown in the fragment; it appears to be configuration/documentation. However, the described auth.json feature that executes shell commands from configuration and captures stdout as an API key is a high-impact security primitive. Combined with local JSON-driven configuration (auth.json/models.json) that can also select arbitrary baseURL destinations, this creates a significant risk of credential harvesting and unauthorized data flow if configuration integrity is compromised in a supply-chain or host-compromise scenario.