pi-dev-rules
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's primary instruction file (SKILL.md) and multiple reference documents (references/cli-and-usage.md, references/development.md) include a command pattern that downloads and immediately executes a shell script from a third-party domain (https://pi.dev/install.sh) using the 'curl | sh' pattern. This method executes remote code with the privileges of the local user without a verification step. While presented as the official installation method for the software documented by the skill, it remains an unverifiable remote execution vector.
Recommendations
- HIGH: Downloads and executes remote code from: https://pi.dev/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata