pi-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs scanning files/envs for API keys, printing grepped lines and diffs, and extracting keys (via awk) into auth.json (ambiguous whether as literal values or lazy shell reads), which would require handling and potentially outputting secrets verbatim unless additional masking is enforced.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly installs and loads untrusted third‑party packages/repos (see references/config-templates.md "扩展安装" with many pi install npm:... and pi install git:github.com/...) and configures/queries an external provider (models.json baseUrl https://api.ant-ling.com), so the agent will fetch and execute/interpret external code and API responses that can materially alter its actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs runtime install commands that fetch and install remote code (e.g., "pi install git:github.com/fluxgear/pi-thinking-steps" and multiple "pi install npm:..." packages), which will download and execute third‑party extensions during setup and thus constitute runtime external dependencies that execute remote code.