The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents mechanisms for overriding the agent's system prompt using files like .pi/SYSTEM.md, ~/.pi/agent/SYSTEM.md, and APPEND_SYSTEM.md. This architecture allows the agent's behavior to be influenced by instructions found in the workspace, creating a surface where malicious instructions could be embedded in a project to hijack agent behavior.
Ingestion points: The agent is instructed to read content from .pi/SYSTEM.md, ~/.pi/agent/SYSTEM.md, and APPEND_SYSTEM.md (found in SKILL.md and CORPUS.md).
Boundary markers: There are no documented delimiters or instructions to treat these external files as untrusted content; they are explicitly used to define the system prompt behavior.
Capability inventory: The agent is given capabilities to write configuration files and change UI/keybinding settings (found in the 'Workflows' section).
Sanitization: No sanitization or validation of the Markdown content is mentioned before it is appended to or replaces the system prompt.
[EXTERNAL_DOWNLOADS]: The skill references an external repository for documentation and verified source code.
Reference: The canonical remote is identified as https://github.com/badlogic/pi-mono in references/CORPUS.md.

pi-customization