pi-mono

This README describes a powerful autonomous agent that intentionally has the capability to execute arbitrary shell commands, read and write arbitrary files in its workspace, install packages, discover and run skill scripts, schedule events triggered by external file writes, and make outbound network requests (including to LLM APIs). As documentation, it is not itself malicious code, but it outlines architectures and behaviors that can be abused for credential theft, data exfiltration, remote code execution, and supply-chain attacks if misconfigured or run with excessive privileges. Key risks: untrusted skills or event files leading to arbitrary code execution, running in host mode or mounting sensitive host paths, and exposure via artifacts server/Cloudflare Tunnel. Recommended precautions: run strictly in isolated Docker with minimal mounts, restrict who can write to the data directory (especially events/ and skills/), use least-privilege tokens, audit tool invocations, and avoid host sandbox mode. Overall: design is high-risk if used carelessly but not inherently malware in the README itself.

This extension system intentionally runs untrusted extension code with broad privileges: file system, shell execution, network access, and agent/provider hooks that can capture or redirect sensitive data. The architecture is feature-rich but lacks sandboxing or a permission model, so any extension (local, global, or installed package) can perform data exfiltration, credential harvesting (especially via provider oauth/getApiKey hooks), execute arbitrary commands, or shadow legitimate tools via first-registration-wins. Therefore the code base poses a high supply-chain risk if unsafe or malicious extensions are introduced. Use of this system requires strong operational controls: audit/whitelist extensions, run in restricted environments, and avoid installing extensions from untrusted sources.