pi-history-ingest
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external text files containing user conversations, tool results, and bash outputs from prior sessions, introducing an indirect prompt injection surface.
- Ingestion points: Processes JSONL history files from
~/.pi/agent/sessions/or the path specified byPI_HISTORY_PATHinSKILL.md(Step 1 and Step 2). - Boundary markers: There are no explicit structural boundary tags or escaping instructions defined for isolating raw text fields when loaded into the model context.
- Capability inventory: The skill writes files to the Obsidian vault path (
$OBSIDIAN_VAULT_PATH) and invokes external CLI tools (findandqmd). - Sanitization: Incorporates defensive mechanisms requiring the removal of API keys, tokens, credentials, and raw long tool payloads prior to ingestion.
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell utilities locally to find files and update indexes.
- Evidence: Utilizes
findto index history files and triggers${QMD_CLI:-qmd} updateand${QMD_CLI:-qmd} embedto refresh the local QMD search index.
Audit Metadata