Arianna Pi Integration

AdvisoryAudited by Static analysis on May 12, 2026.

Overview

Detected: suspicious.prompt_injection_instructions

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Private session history, tool outputs, and prompt content can persist locally and be reused or recalled in later sessions or by other agents sharing the database.

Why it was flagged

The persistence shim stores conversation content, thinking content, tool results, and the full system prompt in a persistent local DAG database.

Skill content

At this point, sending a message to Pi should create nodes in `~/.playfilo/playfilo.db` ... `{ type: "thinking", thinking }` | `"thinking"` ... System prompt ... `"system_prompt"` | The full prompt string

Recommendation

Use only if broad persistent memory is intended. Add explicit opt-in, per-project scoping, redaction/exclusions, strong local file permissions or encryption, and a clear purge/reset command.

ConcernHigh Confidence

ASI01: Agent Goal Hijack

What this means

If `~/.playfilo/INCUBATION_SEED.md` contains unsafe, stale, or modified instructions, the agent may follow those instructions across all Pi runs.

Why it was flagged

A separately maintained local file is prepended to the agent's system prompt on every turn, making that file higher-priority context than the normal prompt.

Skill content

return {
      systemPrompt: seedContent + "\n\n" + event.systemPrompt,
    };

Recommendation

Only install this extension if you fully control and audit the seed file. Lock down file permissions, avoid untrusted writes to `~/.playfilo`, and consider making prompt injection explicit per session rather than automatic every turn.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent could jump to an old memory state and continue from stale or mismatched context, which may affect subsequent coding actions or interpretations of the filesystem.

Why it was flagged

The `tobe` tool is registered as a custom tool and can change the session manager's leaf/context, queue a system-labeled carryover message, and abort the current turn without an explicit human approval step in the shown code.

Skill content

description: "Manifest a specific past state into your current reality..." ... setTobeAbortState(msgs); ... agent.followUp(carryover); agent.abort();

Recommendation

Require user confirmation before any `tobe` state switch, show the target node and carryover message before applying it, and limit time travel to the current project/session unless the user opts in.

ConcernHigh Confidence

ASI08: Cascading Failures

What this means

A poisoned, sensitive, or simply wrong past memory may influence later sessions or other agents using the same database.

Why it was flagged

The design intentionally propagates memory across agents and sessions, so a bad or irrelevant node can become future context outside the original conversation boundary.

Skill content

Both the terminal agent (`playfilo_node.ts`) and Pi share the same SQLite database ... On resume, Pi loads history from the DAG instead of raw JSONL (preserving cross-agent branches)

Recommendation

Use per-project/per-agent namespaces, visible indicators when DAG memory is active, and a safe reset mode that clears or ignores prior refs for new sessions.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Applying the skill modifies the local Pi agent codebase and build environment.

Why it was flagged

The install path is a manual source-code patch with a native SQLite dependency. This is expected for the stated integration, but it changes the host coding agent.

Skill content

cp playfilo-db.ts /path/to/pi-mono/packages/coding-agent/src/core/playfilo-db.ts ... pnpm add better-sqlite3

Recommendation

Review the patch diff before applying, use version control, pin dependency versions, and test in a disposable checkout first.

Findings (3)

warn

suspicious.prompt_injection_instructions

Location: filo/patches/03-session-manager.md:26
Finding: Prompt-injection style instruction pattern detected.

warn

suspicious.prompt_injection_instructions

Location: filo/patches/04-agent-session.md:20
Finding: Prompt-injection style instruction pattern detected.

warn

suspicious.prompt_injection_instructions

Location: filo/patches/05-extension.md:33
Finding: Prompt-injection style instruction pattern detected.