stelow-product-open-source

Warn

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs the agent to install numerous third-party extensions from repositories outside the trusted vendor list. Examples include github.com/PriNova/pi-agent-codebase-workflows in references/cli-tools/safe-change.md and github.com/cursor/plugins in references/cli-tools/codequality-review.md.
  • [REMOTE_CODE_EXECUTION]: Several files provide instructions for downloading and running external code at runtime. references/cli-tools/agent_browser.md uses npx -y @earendil-works/pi-agent-browser, and references/cli-tools/codequality-review.md uses npx skills add to dynamically load new agent capabilities from the NPM registry.
  • [COMMAND_EXECUTION]: The orchestrator's logic involves executing arbitrary code and complex shell commands. references/cli-tools/read-config.md uses node -e to execute a JavaScript string for parsing stelow.json. references/cli-tools/file-locking.md contains sophisticated bash scripting for file locking management using ln, sha1sum, and jq.
  • [DATA_EXFILTRATION]: The skill provides tools that enable network access and cross-session communication. references/cli-tools/agent_browser.md provides an automated browser for interacting with arbitrary URLs, while references/cli-tools/intercom.md facilitates messaging between agent sessions using external packages.
  • [PROMPT_INJECTION]: The references/cli-tools/subagents.md file uses restrictive and authoritative language, such as "⛔ CRITICAL RULE" and "non-negotiable", to override agent defaults and force specific context behaviors during subagent delegation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 18, 2026, 10:49 AM
Security Audit — agent-trust-hub — stelow-product-open-source