The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to install software by piping a remote script directly into the shell (curl -fsSL https://pi.dev/install.sh | sh). This is a high-risk pattern as it executes unverified code from an external server.\n- [EXTERNAL_DOWNLOADS]: Recommends the installation of the @earendil-works/pi-coding-agent package via NPM, which introduces third-party code into the user's local environment.\n- [COMMAND_EXECUTION]: The documentation explains features such as !command and !!command which allow the agent to execute arbitrary shell commands on the host system.\n- [CREDENTIALS_UNSAFE]: The skill describes how to manage and access sensitive credentials stored in ~/.pi/agent/auth.json, including instructions on how to programmatically retrieve secrets using CLI tools.\n- [DATA_EXFILTRATION]: The skill details 'RPC' and 'JSON' modes designed to stream session data and events out of the process, which could be leveraged to exfiltrate information if the tool is used in an untrusted environment.

pi-agent