The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation includes instructions for installing and executing code from unverified external sources. Specifically, it provides commands to run @earendil-works/pi-agent-browser via npx and uses pi install to fetch plugins from GitHub repositories like cursor/plugins and PriNova/pi-agent-codebase-workflows.
[EXTERNAL_DOWNLOADS]: The workflow depends on multiple packages from NPM and GitHub that are not associated with trusted organizations or well-known services. These include tools for task management, structured questioning, and subagent orchestration such as @tintinweb/pi-tasks, @juicesharp/rpiv-todo, and pi-subagents.
[COMMAND_EXECUTION]: The skill uses various shell commands for project coordination and file management. A notable security concern is found in read-config.md, where the stelow_config function executes node -e with shell variable interpolation in the script string (node -e "... wf.config['$field'] ... "). This is a potential command injection vector if the field names used by the agent are not strictly validated.
[PROMPT_INJECTION]: The skill ingests untrusted user data and interpolates it into a complex persona-based prompt, creating a surface for indirect prompt injection.
Ingestion points: SKILL.md defines input fields for <USER INPUT>, <PRODUTOS ATUAIS PARA CLIENTES EXTERNOS>, and <ORGANIZATION CURRENT INTERNAL TOOLS>.
Boundary markers: The skill uses XML-style tags to wrap inputs but does not include explicit instructions to the model to ignore any embedded malicious instructions within that data.
Capability inventory: The skill environment allows for filesystem access, shell command execution, and interaction with external subagents and browsers.
Sanitization: No sanitization, escaping, or schema validation is applied to user inputs before they are included in the generated prompt.

stelow-product-opportunity-mapping