Pi Coding Specialist

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible coding-agent integration, but it asks users or agents to install and run a third-party coding agent globally, including background execution, with weak scoping and unsafe command examples.

Review this before installing. Use only if you trust the Pi npm package and are comfortable with a background coding agent changing project files. Prefer a pinned, project-local or sandboxed install, avoid passing untrusted task text through shell strings, and require explicit user approval before running long background tasks or changing OpenClaw agent configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–52
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

bash

# Install (si no existe)
npm install -g @mariozechner/pi-coding-agent

Technical Analysis

The skill instructs users to install @mariozechner/pi-coding-agent globally without specifying an exact version, validating an integrity hash, or verifying package provenance. Consequently, the installed code depends on whichever package release the npm registry resolves at execution time.

npm packages can execute lifecycle scripts during installation. If the package, its publishing account, or one of its transitive dependencies is compromised, malicious installation code could execute with the permissions of the user running npm. The global installation scope also increases exposure by placing the package in a shared executable location rather than isolating it within the project.

Attack Path

1. An attacker compromises the named npm package, its maintainer account, or a transitive dependency.
2. The attacker publishes a malicious release or modifies a release selected by npm's default resolution behavior.
3. A user follows the skill instructions and runs the unpinned global installation command.
4. npm downloads the attacker-controlled package or dependency.
5. Malicious lifecycle code executes during installation, or the compromised globally installed pi executable runs later.
6. The malicious code operates with the invoking user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account running npm. Depending on that account's privileges, an attacker could read or alter project files, access user-readable credentials and configuration, tamper with globally installed tooling, or compromise subsequent coding-agent operations. The instruction does not explicitly requi ...[truncated 101 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version rather than allowing mutable default resolution.
• Verify package provenance, publisher identity, release signatures where available, and the expected integrity digest before installation.
• Prefer a project-local or otherwise isolated installation instead of npm install -g.
• Use a lockfile or equivalent reproducible dependency mechanism that also fixes transitive dependency versions.
• Review npm lifecycle scripts before installation and use --ignore-scripts when lifecycle execution is unnecessary.
• Run installation and the resulting agent under a dedicated, least-privileged account or sandbox.
• Establish an update process requiring security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:73

Finding

Shell Command Injection Through Untrusted Task Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–78
Vulnerability Type: Shell command injection
Risk Level: High

bash

# 1. Detectar necesidad
if files_changed > 5; then
  # 2. Spawn Pi
  bash pty:true workdir:$PROJECT background:true command:"pi '$TASK'"
  
  # 3. Monitor

Technical Analysis

The workflow interpolates $TASK directly into a shell command string. Placing single-quote characters inside an outer double-quoted expression does not safely encode arbitrary task data. If the task description contains shell-significant quoting or operators, it may terminate the intended argument and introduce additional shell syntax when the generated command is interpreted.

The $PROJECT variable is also unquoted. Spaces, wildcard characters, or shell metacharacters in its value may alter parsing or cause the command to operate in an unintended location. No validation, allowlisting, canonicalization, or structured argument-passing mechanism is shown for either variable.

Because task descriptions may originate from users, issue trackers, repository content, or other external context, treating them as executable shell text creates a boundary violation between data and code.

Attack Path

1. An attacker supplies or influences a task description consumed as $TASK, such as through an untrusted request or repository-controlled task content.
2. The task contains quoting and shell syntax designed to escape the intended single argument.
3. The workflow expands $TASK while constructing command:"pi '$TASK'".
4. The command runner passes the resulting string to a shell interpreter.
5. The shell interprets the injected syntax as one or more additional commands.
6. Those commands execute with the permissions and working-directory access granted to the orchestrating agent.

A related path exists if an attacker can influence $PROJECT: an unquoted value may alter argument parsing or redirect execution into an unintended directory.

...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell commands by concatenating or interpolating task descriptions.
• Invoke pi through a structured process API that accepts the executable and argument list separately, for example an argument vector equivalent to ["pi", task].
• If the integration only supports shell strings, apply a proven shell-escaping routine to every dynamic argument rather than adding literal quote characters manually.
• Quote and validate the project path, resolve it to a canonical path, and require it to remain under an explicitly approved project root.
• Reject null bytes, control characters, and unexpected path values before invocation.
• Run the coding agent in a least-privileged sandbox with access restricted to the required repository.
• Add tests covering task descriptions containing quotes, command separators, substitutions, newlines, spaces, and wildcard characters.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs installing a global npm package and executing shell commands, including background execution, without any safety warning, trust guidance, or approval boundary. This is dangerous because it normalizes system modification and arbitrary command execution from skill documentation, which could lead users or agents to install untrusted code or run commands with unintended side effects.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

## 📁 FILES

- `~/.openclaw/skills/pi-coding-specialist/SKILL.md` (este archivo)
- `~/.openclaw/agents/*/config.json` (subagents.enabled: true)
- `/opt/homebrew/bin/pi` (Pi CLI binary)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language instructions throughout the skill are presented in Spanish, including mission, trigger conditions, and execution guidance, with no indication that users may choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.