pi-custom-model
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill documentation identifies and instructs the agent to access sensitive file paths including
~/.pi/agent/auth.json,~/.pi/agent/settings.json, and~/.pi/agent/models.json. Theauth.jsonfile is a known location for storing provider credentials and API keys. The instructions specifically guide the agent to verify that provider keys exist within this sensitive file. - [COMMAND_EXECUTION]: The skill includes instructions to execute local CLI commands for the
piagent, such aspi --list-modelsandpi --provider <p> --model <id>. These commands are used to verify the state of the local model registry and configuration. - [SAFE]: The skill is primarily instructional and does not contain automated scripts, remote code downloads from untrusted sources, or obfuscated content. The modification of configuration files is consistent with the skill's stated purpose of registering custom model variants.
Audit Metadata