
Research
/Security News
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
pi-skill-toggle
Advanced tools
I have a confession to make. I'm a skill hoarder. We moved from MCP servers polluting our context to now the irresistible urge to gather and hoard skills that then do the same once you gather enough of them. The problem is I'm afraid to remove them and forget that they exist or where to find them in my system, and it's a pain to re-enable them when needed for a specific use case. So I created this project inspired by Pi Skill Palette that lets me enable and disable all the 'SKILLs' I have without them disappearing from my visual memory, but still maintaining control over what gets pumped into my context.
Full credit to nicobailon for pi-skill-palette which was the foundation of this. I just pointed my clanker at that project and basically said "make that project but have it toggle skills instead."
pi install npm:pi-skill-toggle
Or from git:
pi install git:github.com/Whamp/pi-skill-toggle
Restart pi to load the extension.
/skills-toggle
This opens an interactive overlay where you can:
Skills are disabled by adding -path entries to the skills array in ~/.pi/agent/settings.json. For example:
{
"skills": [
"-skills/brainstorming",
"-skills/cloud-compute"
]
}
This uses pi's built-in resource filtering mechanism. Disabled skills:
/skills-toggle UI (shown as disabled)Changes require a restart (or /reload) to take effect.
Use hidden when you still want to call the skill manually via /skill:name but don't want day-to-day context pollution. The model won't auto-invoke it, keeping your system prompt lean, but you retain access when needed.
Examples: Specialized debugging skills, infrequently-used cloud tools, niche domain skills you call explicitly.
Hidden mode sets disable-model-invocation: true in the skill's SKILL.md frontmatter.
Use fully disabled when you want to clean up your slash command menu so less-used skills don't overwhelm your UI/UX. The skill won't appear anywhere—not in the system prompt, not in /skill: completions.
Examples: Deprecated skills, skills from packages you rarely use, duplicates you'll never need.
Disabled mode adds -path entries to settings.json (pi's built-in mechanism).
| Icon | Meaning |
|---|---|
| ● (green) | Enabled - skill active in context |
| ◐ (yellow) | Hidden - manual only via /skill:name |
| ○ (red) | Disabled - completely off |
| * (yellow) | Pending change (not yet saved) |
| ² | Skill has multiple sources (duplicates) |
Create theme.json in the extension directory to customize colors. Copy theme.example.json as a starting point:
{
"border": "2",
"title": "2",
"enabled": "32",
"hidden": "33",
"disabled": "31",
"selected": "36",
"selectedText": "36",
"searchIcon": "2",
"placeholder": "2;3",
"description": "2",
"hint": "2",
"changed": "33",
"duplicate": "35"
}
Values are ANSI SGR codes (e.g., "36" for cyan, "2;3" for dim+italic).
The extension discovers skills from:
~/.codex/skills/ (recursive)~/.claude/skills/ (one level deep).claude/skills/ (project, one level deep)~/.pi/agent/skills/ (recursive)~/.pi/skills/ (recursive).pi/skills/ (project, recursive)MIT
FAQs
Enable/disable skills from loading into pi context at startup
The npm package pi-skill-toggle receives a total of 31 weekly downloads. As such, pi-skill-toggle popularity was classified as not popular.
We found that pi-skill-toggle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.