pi-computer-use
Warn
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches implementation logic and native helpers from GitHub (github.com/injaneity/pi-computer-use) and the NPM registry (@injaneity/pi-computer-use).
- [COMMAND_EXECUTION]: Executes a native Swift bridge binary located at
~/.pi/agent/helpers/pi-computer-use/bridgeto interact with macOS system APIs. - [DATA_EXFILTRATION]: Provides a
screenshottool that captures window images and Accessibility (AX) tree state, exposing sensitive screen content to the agent context. - [COMMAND_EXECUTION]: Grants the agent the ability to perform low-level input actions including
click,keypress,type_text, anddrag, which allows for arbitrary interaction with the host operating system. - [PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection as it ingests untrusted data from application windows.
- Ingestion points: Screen captures and accessibility tree data returned by the
screenshotandlist_windowstools. - Boundary markers: None identified in the skill instructions to separate untrusted window content from agent instructions.
- Capability inventory: Full GUI control via tools like
click,keypress, andset_text. - Sanitization: No evidence of content sanitization or filtering before processing window state.
Audit Metadata