{"id":"cmuxit6ds10g9ad07htlh3blv","slug":"pi-agent","publicId":"beb58857-6f06-4098-b0ad-21ef68cc9ee0","name":"pi-agent","description":"Builds with and operates Pi, the minimal terminal coding harness. Use for installing Pi, configuring providers/models/settings/environment variables, creating Pi skills/extensions/packages/themes/prompt templates, embedding Pi through the SDK, integrating over RPC or JSON event streams, parsing sessions, running local models through the llama.cpp router, developing custom Pi providers and TUI components, or using ecosystem packages such as pi-subagents (delegation/orchestration), pi-mcp-adapter (MCP servers), pi-interview (interactive forms), and pi-web-access (web search, fetching, video understanding).","version":"1.6","author":"k-dense-ai","license":"MIT","compatibility":"Requires Node.js >= 22.19 and npm for Pi CLI and SDK usage. Pi package name is @earendil-works/pi-coding-agent.","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":36,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/k-dense-ai/scientific-agent-skills/tree/main/skills/pi-agent","createdAt":"2026-10-07T03:00:58.289Z","completedAt":"2026-10-07T03:00:58.287Z","visibility":"public","publishedAt":"2026-09-10T21:05:09.506Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 3 warnings in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":["Embedded prompt-template marker","Embedded prompt-template marker","References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmtw0ng57b9hqad079p97wex8","findings":[{"id":"cmuxit6dt10gead07ai02dn36","source":"cisco","category":"security","label":"PROMPT INJECTION detected by YARA","detail":"references/sdk.md:138 — Generic prompt injection patterns: systemPromptOverride","severity":"critical","ruleId":"YARA_prompt_injection_generic","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b8f31fca90a920e6db1f95be009e051e","filepath":"references/sdk.md"},{"id":"cmuxit6dt10gaad07msu250ol","source":"vettd","category":"security","label":"Embedded prompt-template marker","detail":"Detected in references/compaction.md:50 — ``serializeconversation()` renders messages as `[user]:`, `[assistant thinking]:`, `[assistant]:`, `[assistant tool calls`","severity":"medium","ruleId":"VTD-0075","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"88a4e494ca120870540e4179bd7b97e1","filepath":"references/compaction.md"},{"id":"cmuxit6dt10gbad07do5wq8lk","source":"vettd","category":"security","label":"Embedded prompt-template marker","detail":"Detected in references/pi-mcp-adapter.md:172 — `mcp prompt templates register as slash commands `/mcp__<server>__<prompt>`, refreshed on connect. arguments support posi`","severity":"medium","ruleId":"VTD-0075","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c10846ad56877522e40836da5e8666ef","filepath":"references/pi-mcp-adapter.md"},{"id":"cmuxit6dt10gcad07wywu0of9","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmuxit6dt10gdad075zkgou2i","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/overview.md:1 — Pipeline downloads data from the network and executes it: `curl -fsSL https://pi.dev/install.sh | sh`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"d58931c9251218f64beed4d982f82b46","filepath":"references/overview.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":2,"criticalCount":1,"highCount":1},{"source":"vettd","status":"success","verdict":null,"grade":"C","findingCount":3,"criticalCount":0,"highCount":0}],"user":{"name":"Kris Mondlane","image":"https://avatars.githubusercontent.com/u/237055?v=4"},"repository":{"owner":"k-dense-ai","name":"scientific-agent-skills"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T02:36:39.510Z","lastVerifiedAt":"2026-10-22T02:36:39.510Z","lastChangeDetectedAt":"2026-10-07T01:09:15.849Z","scannedHash":"d58e366037de652756b9ca8159abdfa7b79e1486","latestUpstreamHash":"d58e366037de652756b9ca8159abdfa7b79e1486","nextCheckDueAt":"2026-10-23T04:04:34.694Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":1748,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmuxit8li10r5ad07uc29aezk","subjectType":"skill_audit","subjectId":"cmuxit6ds10g9ad07htlh3blv","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:00:53.000Z","payload":null},{"origin":"signal","id":"cmuxit6yd10jgad07apihs1tr","subjectType":"skill_audit","subjectId":"cmuxit6ds10g9ad07htlh3blv","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":1748,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:00:53.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmuxit70z10k1ad07qfru8dg5","subjectType":"skill_audit","subjectId":"cmuxit6ds10g9ad07htlh3blv","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"Requires Node.js >= 22.19 and npm for Pi CLI and SDK usage. Pi package name is @earendil-works/pi-coding-agent.","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:00:53.000Z","payload":null},{"origin":"signal","id":"cmuxit82h10naad07uj76h74l","subjectType":"skill_audit","subjectId":"cmuxit6ds10g9ad07htlh3blv","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"pi-agent","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:00:53.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":28,"publisherSupplied":["name","description","author","version","license"]}