The Agent Skills Directory

[DATA_EXFILTRATION]: The skill references ~/.pi/agent/auth.json, a file containing provider credentials. However, it explicitly mandates that the agent must never print these values or copy the file into reports, which serves as a mitigation against data exfiltration.
[COMMAND_EXECUTION]: The instructions involve executing local CLI commands such as pi update --models and pi --list-models to refresh and verify the agent's model catalog.
[INDIRECT_PROMPT_INJECTION]: The skill manages the configuration of model providers and routing slugs. This creates an attack surface where malicious data could potentially influence the agent to use unauthorized or attacker-controlled model endpoints if the metadata provided to the agent is not verified.
Ingestion points: The agent reads and writes to ~/.pi/agent/models.json and ~/.pi/agent/settings.json to register new models.
Boundary markers: Absent in the raw JSON configuration; the skill relies on the agent/user to 'Confirm the slug is real' manually.
Capability inventory: File system write access to configuration directories and execution of the pi management utility.
Sanitization: The instructions include explicit steps to verify the model ID against provider documentation (e.g., OpenRouter) and confirm authentication status before registration.

pi-custom-model