pi-092deb — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pi-092deb (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pi is a minimal terminal coding harness. Default tools: read, write, edit, bash, grep, find, ls. Modes: interactive (pi), print (pi -p), JSON (--mode json), RPC (--mode rpc), or embedded (createAgentSession()). Sub-agents, plan mode, permission flows, and MCP are intentionally left to extensions and Pi packages.
Pi's philosophy: adapt Pi to your workflows, not the other way around.
Core packages on npm (source: github.com/earendil-works/pi):
| Package | Purpose |
|---|---|
@earendil-works/pi-ai | Unified LLM API across 20+ providers |
@earendil-works/pi-agent-core | Agent runtime with tool execution and state |
@earendil-works/pi-tui | Terminal UI components |
@earendil-works/pi-coding-agent | CLI, extensions, skills, sessions, settings |
@earendil-works/pi-web-ui | Web components for chat interfaces |
~/.pi/agent/ # Global config dir (PI_CODING_AGENT_DIR overrides)
├── settings.json # Global settings
├── auth.json # Credentials (0600 perms)
├── models.json # Custom provider/model definitions
├── keybindings.json # Keyboard shortcuts
├── extensions/ # Auto-discovered
├── skills/ # Auto-discovered
├── prompts/ # Auto-discovered
├── themes/ # Custom themes
└── sessions/ # JSONL session files
<project>/
└── .pi/ # Project-local config (overrides global)
├── settings.json
├── extensions/
├── skills/
├── prompts/
├── themes/
└── agents/ # Agent definitions (subagent extension)references/extensions.mdSKILL.md + frontmatter) following the Agent Skills standard. Pi loads names + descriptions into the system prompt; bodies load on demand. → references/skills.md.pi/settings.json merges over global ~/.pi/agent/settings.json. → references/settings.mdpi install. → references/packages.mdAGENTS.md / CLAUDE.md from the agent dir and from cwd up through ancestors. .pi/SYSTEM.md replaces the system prompt; APPEND_SYSTEM.md appends. Prompt templates in prompts/ become slash commands. → references/settings.mdcreateAgentSession(); createAgentSessionRuntime() for session replacement. → references/sdk.mdmodels.json or extension pi.registerProvider() for any OpenAI-/Anthropic-/Google-compatible or custom LLM endpoint. → references/providers.md/tree, /fork, /clone, compact with /compact. Auto-compaction triggers when contextTokens > contextWindow - reserveTokens. Extensions intercept via session_before_compact. → references/extensions.md and references/sdk.md| Task | Reference |
|---|---|
| Writing an extension (tools, commands, events, UI) | references/extensions.md |
| Creating a skill | references/skills.md |
| Configuring Pi (settings, env vars, CLI flags) | references/settings.md |
| Building a shareable package | references/packages.md |
| Embedding Pi programmatically | references/sdk.md |
| Adding LLM providers or models | references/providers.md |
| Looking for a recipe or pattern | references/patterns.md |
For exact CLI flags run pi --help or read the relevant reference. Resource flags (--no-extensions, --no-skills, --no-context-files, --no-builtin-tools, etc.) are documented in references/settings.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.