Skills/npm/pi-code

pi-code@1.6.1

CAUTION

Publisher claims: "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ilovepixelart · joined 6 days agoInstalls 11,054Last detonated 6d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Instructs the agent to modify its persistent memory or instruction files; Access to sensitive file paths; Outbound HTTP to raw IP address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Process kill commandextensions/internal/process-tree.ts:26 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesextensions/init.ts:66 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandextensions/hooks/index.ts:339 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsextensions/context-imports.ts:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addressextensions/internal/mcp-oauth.ts:282 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsextensions/context-imports.ts:309 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandextensions/hooks/runners.ts:157 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/hooks/runners.ts:150 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/hooks/runners.ts:4 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesextensions/subagent/child.ts:75 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandextensions/internal/atomic-write.ts:34 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsextensions/hooks/matcher.ts:225 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandextensions/hooks/index.ts:387 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/hooks/runners.ts:63 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/internal/process-tree.ts:17 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL using raw IP addressextensions/internal/mcp-oauth.ts:282 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandextensions/hooks/index.ts:930 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/subagent/background.ts:345 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/subagent/background.ts:61 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:42 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:41 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandextensions/subagent/child.ts:94 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/subagent/background.ts:332 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/status-line.ts:383 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/subagent/background.ts:171 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandextensions/subagent/background.ts:384 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:47 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

What would make this Verified

11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim ilovepixelart: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ilovepixelart