
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
pi-amplike
Advanced tools
Pi skills and extensions that provide Amp Code-like workflows (handoff, permissions, mode selector, web access).
Pi skills and extensions that give Pi similar capabilities to Amp Code out of the box.
/handoff <goal> command - Manually create a handoff session (potentially with -mode <name> / -model <name> parameter to switch models for the new session)handoff tool - The agent can invoke this (with optional mode/model parameters) when you explicitly request a handoffsession_query tool - The agent in handed-off sessions automatically gets the ability to query the parent session for context, decisions, or code changes; analysis uses the queried session's own model/resume to switch between and navigate handed-off sessionssubagent tool - The agent can create one or multiple parallel task-focused, non-interactive subagents to save context and speed up work/btw <prompt> command - Same semantics as in Claude Code, basically a user-triggered subagent running and finishing asynchronously and independently on the main agent/permissions command toggles bash command allow/deny permissions, directly read from AmpCode's configuration files./mode command with interactive mode selector/configuration UI (a mode is a model + thinking + color preset, active mode is shown in prompt editor border)Ctrl+Shift+S - mode selectorCtrl+Space - cycle modes~/.config/agents/skills~/.config/amp/skills.agents/skills (project-local)pi install npm:pi-amplike
pi install https://github.com/pasky/pi-amplike
git clone https://github.com/pasky/pi-amplike ~/.pi/packages/pi-amplike
cd ~/.pi/packages/pi-amplike
npm install
Then add "packages/pi-amplike" to the "packages" array in ~/.pi/agent/settings.json.
Get a Jina API key for web skills (optional, works with rate limits without it):
export JINA_API_KEY="your-key" # Add to ~/.profile or ~/.zprofile
Get an API key at jina.ai. Even if you charge only the minimum credit, it's going to last approximately forever.
When your conversation gets long or you want to branch off to a focused task, you can use handoff in two ways:
Manual handoff via command:
/handoff now implement this for teams as well
/handoff -mode rush execute phase one of the plan
/handoff -model anthropic/claude-haiku-4-5 check other places that need this fix
Optional flags (can be combined):
-mode <name> — start the new session in a named mode (e.g. rush, smart, deep)-model <provider/id> — start the new session with a specific model (e.g. anthropic/claude-haiku-4-5)The handoff summary is always generated with the current session's model before switching.
Agent-invoked handoff: The agent can also initiate a handoff when you explicitly ask for it:
"Please hand this off to a new session to implement the fix"
"Create a handoff session to execute phase one"
The handoff tool also accepts optional mode and model parameters.
Both methods create a new session with:
session_query tool)Use Pi's built-in /resume command to switch between sessions, including handed-off sessions. The handoff creates sessions with descriptive names that make them easy to find.
The session_query tool lets the model look up information from previous sessions. It's automatically used when a handoff includes parent session reference, but can also be invoked directly. The analysis call uses the queried session's own model (falling back to the current model if unavailable):
session_query("/path/to/session.jsonl", "What files were modified?")
session_query("/path/to/session.jsonl", "What approach was chosen?")
Ask your agent to "use subagents to ..." whenever you know you have a context-hungry task ahead that you would like to run isolated from the main context window.
When your agent is working on something and you suddenly got a question, use /btw to ask it. Of course, you can even ask multiple questions in parallel. The /btw subagent is ephemeral like tool subagents, but unlike tool subagents it sees the full contxt of your session (besides the fact that it can also use tools to read files).
The permissions extension enforces Amp-style bash command permissions automatically. Use the /permissions command to toggle modes:
/permissions # toggles between enabled and yolo
~/.config/amp/settings.json are enforcedYOLO mode shown in status barThe selected mode is persisted in ~/.pi/agent/amplike.json and restored on the next pi invocation.
/mode # mode picker
/mode configure # open mode configuration UI
/mode <name> # switch directly
/mode store <name> # store current model+thinking into a mode
Notes:
rush, smart, and deep; they somewhat mirror Amp defaults..pi/modes.json (project), falling back to ~/.pi/agent/modes.json (global)."modes": {} in your modes file disables mode overlay behavior (shortcuts + editor mode border), while keeping /mode config UI available.~/.pi/packages/pi-amplike/skills/web-search/search.py "python async tutorial"
~/.pi/packages/pi-amplike/skills/visit-webpage/visit.py https://docs.example.com/api
| Component | Type | Description |
|---|---|---|
| amp-skills | Extension | Adds Amp-compatible skill discovery paths (~/.config/agents/skills, ~/.config/amp/skills, .agents/skills) |
| permissions | Extension | Reads amp.commands.allowlist and amp.permissions from ~/.config/amp/settings.json (and .agents/settings.json) and intercepts bash tool calls accordingly; /permissions toggles between enabled and yolo (all commands allowed, status bar indicator, persisted in ~/.pi/agent/amplike.json) |
| handoff | Extension | /handoff [-mode <name>] [-model <provider/id>] <goal> command + handoff tool (with mode/model params) for AI-powered context transfer |
| modes | Extension | Prompt mode manager with model/thinking/color presets, editor border overlay, and shortcuts |
| session-query | Extension | session_query tool for querying parent sessions; uses the queried session's own model for analysis |
| session-query | Skill | Instructions for using the session_query tool |
| web-search | Skill | Web search via Jina API |
| visit-webpage | Skill | Webpage content extraction |
Amp Code has excellent session management built-in - you can branch conversations, reference parent context, and navigate session history. This package brings similar workflows to Pi:
The web-search and visit-webpage skills were extracted from pasky/muaddib. The original implementations have additional features (rate limiting, multiple backends, async execution) that aren't needed for Pi's skill system.
MIT
FAQs
Pi skills and extensions that provide Amp Code-like workflows (handoff, permissions, mode selector, web access).
We found that pi-amplike demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.