
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@gaodes/pi-dev-kit
Advanced tools
Developer toolkit for Pi — modular skills for authoring extensions, skills, prompt templates, themes, packages, and context files. Includes introspection tools for version, docs, changelog, benchmarking, and loaded tools.
Developer toolkit for the Pi coding agent.
| Tool | Description |
|---|---|
pi_version | Returns the currently running Pi version. |
pi_docs | Lists Pi markdown documentation files from the installation directory. |
pi_changelog | Returns changelog entries for a specific Pi version (or latest). Fetches from GitHub for versions newer than installed. |
pi_changelog_versions | Lists all available Pi changelog versions. |
pi_ext_benchmark | Profile Pi extension loading times — discovers all extensions (global, project-local, packages) and measures import + factory execution time per extension. Actions: profile (default), list. Scopes: all, global, project, packages. |
loaded_tools | List all loaded tools with source provenance and active status. Returns tools grouped by source (built-in, SDK, extensions) with active/inactive indicators and per-extension grouping. |
| Command | Description |
|---|---|
/tools | List all loaded tools with source provenance and active status. |
By default, the tools list is not shown at session start. To enable it, add to ~/.pi/agent/prime-settings.json:
{
"pi-dev-kit": {
"showOnStartup": true
}
}
Or per-project in .pi/prime-settings.json.
| Skill | Description |
|---|---|
pi-extension | Comprehensive Pi extension development reference — tools, hooks, commands, components, modes, state, providers, testing, publishing, and 12 API reference docs |
demo-setup | Demo project setup guide for new Pi extensions |
version-tool and docs-tool to defineTool API with ToolCallHeader renderingpromptSnippet and promptGuidelines to upgraded toolspi-extension skill with 12 reference docs from upstreamdemo-setup skill and setup-demo prompt from upstream@aliou/pi-utils-ui dependency for ToolCallHeader/ToolBody renderingpi_ext_benchmark tool — profile extension loading timesloaded_tools tool — list all tools with source provenance/tools command and message renderershowOnStartup)pi_version, pi_docs, pi_changelog, pi_changelog_versionsdetect_package_manager and pi_package_manager tools.pi_updater tool and /update command.FAQs
Developer toolkit for Pi — modular skills for authoring extensions, skills, prompt templates, themes, packages, and context files. Includes introspection tools for version, docs, changelog, benchmarking, and loaded tools.
The npm package @gaodes/pi-dev-kit receives a total of 9 weekly downloads. As such, @gaodes/pi-dev-kit popularity was classified as not popular.
We found that @gaodes/pi-dev-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.