The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses node -e in SKILL.md to update state files like stelow.json. It interpolates variables such as {TASKS_JSON_FROM_PARSED_TABLE} and {DISCOVERED_TASK_JSON} directly into the shell command string as JavaScript literals. If the source plan files (e.g., spec-tech.md) provide malicious strings designed to escape JavaScript quotes, this pattern allows for arbitrary code execution within the shell environment.
[EXTERNAL_DOWNLOADS]: Several reference files (e.g., agent_browser.md, codequality-review.md, safe-change.md, and todo.md) instruct the agent to install or run packages from third-party developers. Examples include @earendil-works/pi-agent-browser, Prinova/pi-agent-codebase-workflows, and @tintinweb/pi-tasks. These developers and their repositories are not included in the provided trusted vendors list.
[PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface. It reads 'Definition of Done' criteria and task instructions from spec-tech.md and spec-product.md files, which are then passed directly to subagents for autonomous execution. A compromised plan file could contain instructions designed to override agent behavior or perform unauthorized actions.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code through commands like npx and pi install targeting third-party GitHub repositories and NPM packages. Without source verification or integrity checks for these external dependencies, this creates a supply chain risk for the agent environment.

stelow-product-scope-executor