The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and forwarding of untrusted data from user requests to a command-line interface. Ingestion points: User task text and request arguments are ingested via the pi:pi-companion-forwarder subagent as described in SKILL.md. Boundary markers: There are no instructions for using delimiters or boundary markers to isolate the user-provided task text from the command's control logic. Capability inventory: The skill utilizes shell execution capabilities to run a local script via node (referenced in SKILL.md). Sanitization: The instructions explicitly direct the agent to "Preserve the user's task text as-is," which bypasses the validation or escaping of potentially malicious characters or instructions.
[DYNAMIC_EXECUTION]: The skill defines a process where an executable command is assembled at runtime using string concatenation: node "${CLAUDE_PLUGIN_ROOT}/scripts/pi-companion.mjs" task "<raw arguments>". This dynamic construction of shell commands from untrusted inputs presents a risk of command injection, where shell metacharacters could be used to execute unintended code.

pi-cli-runtime