pi-setup
Warn
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs an extensive scan of sensitive local files to discover API keys, targeting shell profiles like ~/.zshrc, ~/.bashrc, ~/.profile, and ~/.zshenv, as well as secret-specific files like ~/.deepseek and ~/.zenmux.
- [DATA_EXFILTRATION]: Identified API keys are sent to external third-party domains including zenmux.ai and api.ant-ling.com using curl to validate credentials. These endpoints are not listed as trusted or well-known services.
- [DYNAMIC_EXECUTION]: The skill generates configuration files (auth.json and models.json) that utilize the Pi Agent's specific !command syntax. This causes the agent to execute shell commands like awk or zsh -ic at runtime to dynamically fetch secrets.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute system discovery commands, read sensitive files, modify file permissions (chmod 600), and install software via the pi install utility.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the user's shell environment and local files. This data is processed and interpolated into commands and configuration templates, presenting a risk of command injection if the input files contain malicious patterns.
- [EXTERNAL_DOWNLOADS]: The skill installs multiple third-party extensions from NPM and GitHub repositories, including sources such as github.com/fluxgear/pi-thinking-steps that are not associated with trusted organizations.
Audit Metadata