pi
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bash command
pi -p "$ARGUMENTS" ...where user-supplied input is directly interpolated. This allows for command injection via command substitution (e.g., using backticks or $(...)) which the shell will evaluate even within double quotes.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for an external coding agent, creating a vulnerability surface for indirect prompt injection.\n - Ingestion points: Untrusted task descriptions are ingested via the
$ARGUMENTSvariable in SKILL.md.\n - Boundary markers: There are no delimiters or instructions provided to separate the task description from the agent's control instructions.\n
- Capability inventory: As stated in SKILL.md, the sub-agent (pi) has the capability to "write files directly" to the local environment, presenting a significant risk if the agent is subverted.\n
- Sanitization: No sanitization, filtering, or escaping is applied to the input before it is passed to the shell or the secondary agent.
Recommendations
- AI detected serious security threats
Audit Metadata