The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in agent_browser.md instructs the agent to use npx -y to download and execute the @earendil-works/pi-agent-browser package. The -y flag is a high-risk pattern that bypasses the standard npm confirmation prompt, allowing for the silent download and execution of untrusted third-party code at runtime.
[EXTERNAL_DOWNLOADS]: Multiple reference files (e.g., codequality-review.md, safe-change.md, todo.md, intercom.md) recommend installing tools and plugins from untrusted GitHub repositories and npm packages, such as PriNova/pi-agent-codebase-workflows, @tintinweb/pi-tasks, and pi-intercom. These instructions introduce unvetted third-party dependencies into the agent's environment without version pinning or integrity verification. A reference to Cursor's GitHub repository for code quality plugins is also included.
[COMMAND_EXECUTION]: The read-config.md utility uses node -e to execute dynamically generated JavaScript code strings at runtime to parse configuration from stelow.json. Additionally, supervise.md and subagents.md describe mechanisms for spawning headless CLI processes (e.g., pi --print) to perform orchestrated tasks, which represents a significant capability surface.
[PROMPT_INJECTION]: The agent_browser.md tool ingests data from external URLs (ingestion point) without specified boundary markers or sanitization logic. This untrusted data is processed in a context where the agent has access to powerful tools like shell execution and subagent delegation (capability inventory), creating a risk of indirect prompt injection where a malicious website could take control of the agent's workflow.

stelow-product-promotions