The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The reference documentation (e.g., codequality-review.md, safe-change.md, subagents.md) instructs the agent to install several third-party tools from unverified GitHub and NPM sources using pi install and npx. These include tools from authors like earendil-works, cursor, plannotator, PriNova, tintinweb, and juicesharp, none of whom are in the trusted vendors list.
[REMOTE_CODE_EXECUTION]: Files such as agent_browser.md and plannotator.md define fallback commands that use npx to download and immediately execute code from remote registries at runtime (e.g., @earendil-works/pi-agent-browser and @plannotator/pi-extension).
[COMMAND_EXECUTION]: The execution loop protocol described in execution-loop.md reads and executes arbitrary shell commands defined in a verifyCommands list within a project's spec-tech.md configuration file.
[PROMPT_INJECTION]: The skill processes data ingested from project configuration files (spec-tech.md, stelow.json, spec-product.md) to drive logic and tool parameters without utilizing explicit boundary markers or sanitization, creating a surface for indirect prompt injection.
Ingestion points: spec-tech.md, stelow.json, spec-product.md in references/cli-tools/ and SKILL.md context.
Boundary markers: Absent.
Capability inventory: Shell execution (bash), subagent delegation via Agent() and subagent(), and file management.
Sanitization: Absent.

stelow-product-pricing