pi-computer-use
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads code and dependencies from untrusted sources, including a GitHub repository (
github.com/injaneity/pi-computer-use) and an NPM package (@injaneity/pi-computer-use). - [REMOTE_CODE_EXECUTION]: During installation and runtime, the skill fetches and executes a native Swift bridge and a TypeScript bridge from an untrusted remote source. The instruction to grant Accessibility and Screen Recording permissions to the local bridge binary (
~/.pi/agent/helpers/pi-computer-use/bridge) allows this remote code to operate with high privileges on the host system. - [COMMAND_EXECUTION]: The skill provides the agent with the ability to execute arbitrary user interface actions, including
keypress,type_text,click, andcomputer_actions, effectively giving the AI full control over the desktop environment. - [DATA_EXFILTRATION]: The
screenshottool and the Accessibility (AX) state collection mechanisms allow for the harvesting of visual and textual data from all visible windows. This includes potentially sensitive information such as private messages, browser content, or configuration screens. - [PRIVILEGE_ESCALATION]: The skill explicitly instructs the user to grant macOS 'Accessibility' and 'Screen Recording' permissions. These permissions allow the application to bypass standard sandbox restrictions, enabling it to observe other applications and inject input into them.
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the user interface of other applications.
- Ingestion points: UI content is ingested via the
screenshottool and the Accessibility state returned by every action. - Boundary markers: No delimiters or safety instructions are defined to separate UI content from agent instructions.
- Capability inventory: The skill possesses powerful capabilities to interact with the system, including
set_text,keypress, andclick. - Sanitization: There is no mention of sanitizing or filtering text labels or accessibility data retrieved from target windows.
Audit Metadata