The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/cli-tools/agent_browser.md instructs the use of npx -y @earendil-works/pi-agent-browser. This command downloads and executes code from an unverified NPM package at runtime, representing a high-risk execution pattern.
[EXTERNAL_DOWNLOADS]: Multiple tool definitions (references/cli-tools/safe-change.md, references/cli-tools/codequality-review.md) recommend installing software from unverified GitHub repositories, such as github.com/PriNova/pi-agent-codebase-workflows and github.com/cursor/plugins (note: while Cursor is a known service, it is not explicitly listed as a trusted vendor).
[EXTERNAL_DOWNLOADS]: The skill references several third-party NPM packages for core functionality, including @tintinweb/pi-subagents, @juicesharp/rpiv-ask-user-question, and @tintinweb/pi-tasks, none of which originate from verified trusted organizations.
[COMMAND_EXECUTION]: references/cli-tools/read-config.md utilizes node -e to execute inline JavaScript snippets. While used for configuration parsing, dynamic code execution via the shell is a sensitive pattern that can be exploited if input variables are not properly handled.
[DATA_EXFILTRATION]: The automated browser tool documented in references/cli-tools/agent_browser.md provides capabilities to visit arbitrary URLs and capture screenshots/DOM snapshots. This could be used to exfiltrate sensitive local data if an agent is redirected to a malicious endpoint while having internal context.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to the ingestion of untrusted data from the web.
Ingestion points: agent-browser tool (in references/cli-tools/agent_browser.md) reads live web content.
Boundary markers: Absent in the provided tool documentation.
Capability inventory: The orchestrator suite includes full shell access (bash), file writes (todo.md), and the ability to spawn autonomous subagents (subagents.md).
Sanitization: No evidence of sanitization or instruction-filtering for content retrieved from external URLs.

stelow-product-ads