The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for installing and running several external utilities required for its auditing workflow. These include @earendil-works/pi-agent-browser for rendered UI verification, cursor/plugins for maintainability gates, PriNova/pi-agent-codebase-workflows for regression analysis, and @tintinweb/pi-tasks for task management. These are typically installed via npm, npx, or the platform's native pi-extension installer.
[COMMAND_EXECUTION]: The skill uses a wide array of system commands to manage its operations. This includes using find and grep for codebase discovery, git for status reporting and overlap detection, and specialized CLI tools like plannotator for interactive review gates. It also implements a convention-based file-locking protocol using ln and sha1sum to safely coordinate parallel work across multiple agent sessions.
[REMOTE_CODE_EXECUTION]: A canonical helper script is provided to dynamically parse project configurations. It uses node -e to execute inline JavaScript for reading the stelow.json file. This is used to extract workflow settings such as appetite levels and review modes into environment variables.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because its primary function is to ingest and analyze external source code. Maliciously crafted comments or code patterns within the target repository could attempt to influence the reviewer subagent's findings. This risk is inherent to the audit task and is addressed by instructions that encourage the use of isolated 'fresh' contexts for subagent execution to prevent cross-task data leakage.

stelow-product-codebase-critique