pi-custom-model
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions direct the agent to access
~/.pi/agent/auth.json, which is explicitly described as containing provider credentials such asOPENROUTER_API_KEY. Accessing this file exposes sensitive secrets to the model's context, creating a high risk of accidental or malicious exfiltration.\n- [COMMAND_EXECUTION]: The skill requires running shell commands likepi --list-models | grep <id>andpi --provider <p> --model "<id>". These commands incorporate user-supplied parameters (<id>,<p>) without sanitization, providing a vector for shell command injection if the input contains malicious metacharacters.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerable attack surface for configuration poisoning.\n - Ingestion points: User-provided model slugs, cost data, and metadata provided in the request body are processed in SKILL.md.\n
- Boundary markers: None; the instructions lack delimiters or warnings to ignore malicious instructions embedded in the model IDs or metadata.\n
- Capability inventory: The skill writes to
settings.jsonandmodels.jsonand executes thepiCLI tool.\n - Sanitization: None; metadata and IDs are interpolated directly into JSON structures and shell commands without validation.
Recommendations
- AI detected serious security threats
Audit Metadata