pi-mono

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository exposes multiple powerful extension/plugin and tooling surfaces (dynamic extension loading, arbitrary shell execution, provider-payload hooks, package installation, remote SSH/script deployment, and a Slack bot that runs shell commands) that — while intended for extensibility — provide clear, direct primitives an attacker could use for data exfiltration, credential theft, remote code execution, or supply‑chain abuse; no strong sandbox or automatic reviewer/consent barrier is enforced by the runtime in many of these flows.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The coding-agent extension system explicitly discovers and executes arbitrary external extensions from user/local paths (.pi/extensions, ~/.pi/extensions) and remote packages (settings "packages" allowing npm:@foo/bar and git:github.com/...), and those extensions (per packages/coding-agent/docs/extensions.md and extensions/loader.ts) can modify system prompts, transform context, intercept/modify provider payloads, and register tools/commands—i.e., untrusted third-party content is ingested and can materially change agent behavior, enabling indirect prompt injection.