The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes several third-party Node.js packages at runtime, including @earendil-works/pi-agent-browser (via npx), @tintinweb/pi-tasks, @juicesharp/rpiv-todo, and @juicesharp/rpiv-ask-user-question. These sources are not in the predefined trusted list.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and install extensions directly from external Git repositories, notably github.com/PriNova/pi-agent-codebase-workflows. It also references github.com/cursor/plugins, which originates from a well-known service.
[COMMAND_EXECUTION]: The tool read-config.md uses node -e to dynamically execute JavaScript for parsing the stelow.json configuration file. While the source file is local, this pattern involves dynamic code execution.
[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands via bash and the pi CLI to handle file-reservation locking, subagent orchestration, and headless supervision checkpoints.
[COMMAND_EXECUTION]: The supervise.md tool executes headless commands (e.g., pi --print ...) to perform checkpoint-based verification of the agent's progress against the Definition of Done.

stelow-product-health