pi-agent
2 findings (1 critical, 1 low), mainly data exfiltration, prompt injection. Most recent scan 2026-10-21.
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Builds with and operates Pi, the minimal terminal coding harness. Use for installing Pi, configuring providers/models/settings/environment variables, creating Pi skills/extensions/packages/themes/prompt templates, embedding Pi through the SDK, integrating over RPC or JSON event streams, parsing sessions, running local models through the llama.cpp router, developing custom Pi providers and TUI components, or using ecosystem packages such as pi-subagents (delegation/orchestration), pi-mcp-adapter (MCP servers), pi-interview (interactive forms), and pi-web-access (web search, fetching, video…
- Package
- 36 files, 270 KB
- SKILL.md
- 928 words, 7 sections
- Code
- None. Instructions only.
- License
- MIT
- Compatibility
- Requires Node.js >= 22.19 and npm for Pi CLI and SDK usage. Pi package name is @earendil-works/pi-coding-agent.
SKILL.md covers: Pi Agent · First Decision · Build-On-Pi Defaults · Safety Defaults · Common Commands · Source Coverage · Citing Scientific Agent Skills
Findings
CRITICAL PROMPT INJECTION detected by YARA Prompt Injectionstatic
Generic prompt injection patterns: systemPromptOverride
references/sdk.md:138
`DefaultResourceLoader` discovers extensions, skills, prompts, themes, and context files. Options: `cwd`, `agentDir`, `additionalExtensionPaths`, `extensionFactories` (bare functions or `InlineExtension { name, factory }` so the startup list shows `<inline:my-provider>` instead of `<inline:1>`), `settingsManager`, `systemPromptOverride`, `skillsOverride`, `promptsOverride`, `agentsFilesOverride`, `eventBus` (from `createEventBus()`). Call `await loader.reload()`, then read `getExtensions()`, `getSkills()`, `getPrompts()`, `getThemes()`, `getAgentsFiles().agentsFiles`.LOW Dangerous data flow in command pipeline Data Exfiltrationpipeline
Pipeline downloads data from the network and executes it: `curl -fsSL https://pi.dev/install.sh | sh`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)
references/overview.md:1
curl -fsSL https://pi.dev/install.sh | shWhat is in the package
36 files, 270 KB. Show the list.
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 8.1 KB |
references/compaction.md | doc | 5.7 KB |
references/containerization.md | doc | 3.8 KB |
references/custom-provider.md | doc | 9.0 KB |
references/development.md | doc | 1.9 KB |
references/environment-variables.md | doc | 4.0 KB |
references/extensions.md | doc | 20 KB |
references/json.md | doc | 3.6 KB |
references/keybindings.md | doc | 5.6 KB |
references/llama-cpp.md | doc | 3.4 KB |
references/mcp.md | doc | 5.9 KB |
references/models.md | doc | 9.4 KB |
references/overview.md | doc | 2.1 KB |
references/packages.md | doc | 6.2 KB |
references/pi-interview.md | doc | 7.9 KB |
references/pi-mcp-adapter.md | doc | 24 KB |
references/pi-subagents.md | doc | 45 KB |
references/pi-web-access.md | doc | 15 KB |
references/prompt-templates.md | doc | 1.8 KB |
references/providers.md | doc | 9.1 KB |
references/quickstart.md | doc | 2.7 KB |
references/rpc.md | doc | 9.4 KB |
references/sdk.md | doc | 13 KB |
references/security.md | doc | 4.7 KB |
references/session-format.md | doc | 6.1 KB |
references/sessions.md | doc | 3.0 KB |
references/settings.md | doc | 8.4 KB |
references/shell-aliases.md | doc | 772 B |
references/skills.md | doc | 4.1 KB |
references/terminal-setup.md | doc | 4.3 KB |
references/termux.md | doc | 1.3 KB |
references/themes.md | doc | 2.2 KB |
references/tmux.md | doc | 1.7 KB |
references/tui.md | doc | 7.7 KB |
references/usage.md | doc | 8.6 KB |
references/windows.md | doc | 1.1 KB |
External hosts referenced
pi.dev github.com arxiv.org agent-plugins.org agentskills.io api.openai.com docs.nvidia.com doi.org export.arxiv.org generativelanguage.googleapis.com git-scm.com shittycodingagent.ai sw.kovidgoyal.net www.npmjs.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
CLOUDFLARE_API_KEY CLOUDFLARE_ACCOUNT_ID PI_CODING_AGENT_DIR HF_TOKEN MY_API_KEY PI_MODEL PI_PROVIDER ANTHROPIC_API_KEY AWS_BEARER_TOKEN_BEDROCK AZURE_OPENAI_API_KEY CLOUDFLARE_GATEWAY_ID CONFIG_DIR_NAME PI_CODING_AGENT_SESSION_DIR QWEN_TOKEN_PLAN_API_KEY XAI_API_KEY AI_GATEWAY_API_KEY ANTHROPIC_AUTH_TOKEN ANTHROPIC_FEDERATION_RULE_ID ANTHROPIC_IDENTITY_TOKEN_FILE ANTHROPIC_OAUTH_TOKEN ANTHROPIC_ORGANIZATION_ID ANT_LING_API_KEY AWS_ACCESS_KEY_ID AWS_BEDROCK_FORCE_CACHE AWS_DEFAULT_REGION AWS_ENDPOINT_URL_BEDROCK_RUNTIME AWS_PROFILE AWS_REGION AWS_SECRET_ACCESS_KEY AWS_WEB_IDENTITY_TOKEN_FILE
Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Bytecode analyzer.
- Pipeline analyzer.
- Correlation analyzer.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/K-Dense-AI/scientific-agent-skills
- Raw scan result: skills-pi-agent-scan.json
- Badge for your README:
- Request a re-scan