pi-29e3c6 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pi-29e3c6 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pi is a minimal terminal coding harness. Default tools: read, bash, edit, write; grep, find, ls, and the Windows powershell tool are opt-in via the defaultTools setting or --tools. Built-in extensions (Pi 0.99.0) add MCP servers, the codemode tool (model-written JavaScript that calls other tools), and tool_search. codemode and tool_search start inactive: enable them with defaultTools/--tools, or let MCP activate them when a server needs them. Modes: interactive (pi), print (pi -p), JSON (--mode json), RPC (--mode rpc), or embedded (createAgentSession()). Sub-agents, plan mode, and permission flows are intentionally left to extensions and Pi packages. Skill synced with Pi 1.2.0.
Pi's philosophy: adapt Pi to your workflows, not the other way around.
Core packages on npm (source: github.com/earendil-works/pi):
| Package | Purpose |
|---|---|
@earendil-works/pi-ai | Unified LLM API across 20+ providers |
@earendil-works/pi-agent-core | Agent, the agent loop, and the proxy stream (Pi 1.0.0 removed the experimental harness, sessions, and its ./node/./harness/* subpaths) |
@earendil-works/pi-tui | Terminal UI components |
@earendil-works/pi-coding-agent | CLI, extensions, skills, sessions, settings (also exports ./rpc-entry) |
@earendil-works/pi-codemode | QuickJS sandbox that runs model-written JavaScript against injected tools (Pi 0.99.0) |
@earendil-works/pi-mcp | Standalone MCP client: stdio and streamable HTTP, OAuth (Pi 0.99.0) |
@earendil-works/pi-telemetry | Vendor-neutral telemetry contracts (Pi 0.84.0) |
@earendil-works/pi-durable | Experimental durable agent harness: conversations, turns, and tool calls committed to storage and resumed after a crash (Pi 1.0.0; replaces the pi-agent-core harness) |
~/.pi/agent/ # Global config dir (PI_CODING_AGENT_DIR overrides)
├── settings.json # Global settings
├── auth.json # Credentials (0600 perms)
├── models.json # Custom provider/model definitions
├── mcp.json # MCP servers (mcp-auth.json holds their OAuth tokens)
├── keybindings.json # Keyboard shortcuts
├── extensions/ # Auto-discovered
├── skills/ # Auto-discovered
├── prompts/ # Auto-discovered
├── themes/ # Custom themes
└── sessions/ # JSONL session files
<project>/
└── .pi/ # Project-local config (overrides global)
├── settings.json
├── mcp.json # Project MCP servers (read only once trusted)
├── extensions/
├── skills/
├── prompts/
├── themes/
└── agents/ # Agent definitions (subagent extension)references/extensions.mdSKILL.md + frontmatter) following the Agent Skills standard. Pi loads names + descriptions into the system prompt; bodies load on demand. → references/skills.mdmcp.json or pi.registerMcpServer(); server tools default to codemode exposure, reachable from codemode scripts rather than declared to the model. Codemode scripts get a tool's structuredContent when it declares outputSchema, and their nested calls still reach tool_call gates. → references/mcp.md and references/codemode.md.pi/settings.json merges over global ~/.pi/agent/settings.json. → references/settings.mdpi install. → references/packages.md~/.pi/agent/trust.json. --approve/--no-approve override per run; defaultProjectTrust sets the non-interactive fallback. → references/settings.mdAGENTS.md / CLAUDE.md from the agent dir and from cwd up through ancestors. Per-directory AGENTS.override.md (Pi 0.84.0) replaces same-directory context files while others layer normally. .pi/SYSTEM.md replaces the system prompt; APPEND_SYSTEM.md appends. Prompt templates in prompts/ become slash commands. → references/settings.mdcreateAgentSession(); createAgentSessionRuntime() for session replacement. → references/sdk.mdmodels.json or extension pi.registerProvider() (config form or complete pi-ai providers) for any OpenAI-/Anthropic-/Google-compatible or custom LLM endpoint. → references/providers.md/tree, /fork, /clone, compact with /compact. Auto-compaction triggers when contextTokens > contextWindow - reserveTokens. Extensions intercept via session_before_compact. Since Pi 0.87.0 SessionManager is canonical for model context: append-only context_edit entries omit or replace messages in future requests without rewriting history. → references/extensions.md and references/sdk.md| Task | Reference |
|---|---|
| Writing an extension (tools, commands, events, UI) | references/extensions.md |
Connecting MCP servers (mcp.json, pi mcp, exposure) | references/mcp.md |
| Codemode scripts, tool exposure, nested tool calls, permission gates for them | references/codemode.md |
| Creating a skill | references/skills.md |
| Configuring Pi (settings, env vars, CLI flags) | references/settings.md |
| Building a shareable package | references/packages.md |
| Embedding Pi programmatically | references/sdk.md |
| Adding LLM providers or models, classifiers, image models, virtual models | references/providers.md |
| Looking for a recipe or pattern | references/patterns.md (compilable examples in examples/) |
For exact CLI flags run pi --help or read the relevant reference. Resource flags (--no-extensions, --no-skills, --no-context-files, --no-builtin-tools, etc.) are documented in references/settings.md; --no-extensions also disables the built-in extensions, and -e builtin:<name> loads one back.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.