stelow-product-open-source
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to install numerous third-party extensions from repositories outside the trusted vendor list. Examples include
github.com/PriNova/pi-agent-codebase-workflowsinreferences/cli-tools/safe-change.mdandgithub.com/cursor/pluginsinreferences/cli-tools/codequality-review.md. - [REMOTE_CODE_EXECUTION]: Several files provide instructions for downloading and running external code at runtime.
references/cli-tools/agent_browser.mdusesnpx -y @earendil-works/pi-agent-browser, andreferences/cli-tools/codequality-review.mdusesnpx skills addto dynamically load new agent capabilities from the NPM registry. - [COMMAND_EXECUTION]: The orchestrator's logic involves executing arbitrary code and complex shell commands.
references/cli-tools/read-config.mdusesnode -eto execute a JavaScript string for parsingstelow.json.references/cli-tools/file-locking.mdcontains sophisticated bash scripting for file locking management usingln,sha1sum, andjq. - [DATA_EXFILTRATION]: The skill provides tools that enable network access and cross-session communication.
references/cli-tools/agent_browser.mdprovides an automated browser for interacting with arbitrary URLs, whilereferences/cli-tools/intercom.mdfacilitates messaging between agent sessions using external packages. - [PROMPT_INJECTION]: The
references/cli-tools/subagents.mdfile uses restrictive and authoritative language, such as "⛔ CRITICAL RULE" and "non-negotiable", to override agent defaults and force specific context behaviors during subagent delegation.
Audit Metadata