The Agent Skills Directory

[COMMAND_EXECUTION]: The tool provides a built-in bash tool and CLI shortcuts (!command and !!command) that allow for arbitrary shell command execution on the host system as part of its interactive coding environment.
[EXTERNAL_DOWNLOADS]: Through the pi install command, the skill facilitates the downloading and installation of extensions, skills, and prompts from external sources including npm, git repositories (via HTTPS or SSH), and direct URLs.
[REMOTE_CODE_EXECUTION]: Extensions and packages installed via the CLI are executed with full system access, creating a risk of unauthorized code execution if a user is prompted to install a malicious package.
[DATA_EXFILTRATION]: The agent accesses and manages sensitive authentication credentials (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY) and stores them in ~/.pi/agent/auth.json. Additionally, the read tool permits the agent to access any file within the filesystem reachable by the user.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection where malicious instructions embedded in project files could influence the agent's behavior.
Ingestion points: The agent automatically discovers and reads instructions from project-level files such as AGENTS.md, CLAUDE.md, and .pi/SYSTEM.md, as well as files explicitly referenced via the @ symbol in the CLI.
Boundary markers: The documentation does not specify any delimiters or special markers used to isolate untrusted file content from the agent's core instructions.
Capability inventory: The agent possesses high-impact capabilities including bash command execution, file system modification (write, edit tools), and package management (pi install).
Sanitization: There is no evidence of sanitization, validation, or filtering of the content ingested from local project files before it is processed by the model.

pi-coding-agent