The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads session logs from ~/.pi/agent/sessions/. These files contain the complete history of user-agent interactions, which can include sensitive source code, internal data, and conversation history. While access is necessary for the skill's primary function, it constitutes significant data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from past sessions to generate security allowlist recommendations. This creates an attack surface where malicious commands or file paths encountered in previous interactions could be promoted for permanent authorization.
Ingestion points: Reads ~/.pi/agent/sessions/*.jsonl to extract command and path history.
Boundary markers: Processes data using structured JSON parsing and regex; final recommendations are presented for human review.
Capability inventory: The skill can modify the agent's core security configuration (guardrails.json) and execute various analysis scripts.
Sanitization: Employs safety logic to skip inherently dangerous commands (e.g., rm -rf, mkfs) and overbroad paths (e.g., /etc, /usr/bin).
[PRIVILEGE_ESCALATION]: The skill modifies guardrails.json in both project and global scopes. By adding entries to allowedPaths and allowedPatterns, it permanently grants the agent permission to perform actions that previously required user approval. This is the intended purpose of the skill but represents a fundamental change to the security posture.
[COMMAND_EXECUTION]: Executes local Node.js and Python helper scripts to perform scanning and analysis tasks. These scripts process user history and generate the data used for security configuration updates.

guardrail-optimizer