The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the installation of the 'cymbal' tool using a high-risk pattern that pipes a remote PowerShell script directly into an execution engine (iex).
Evidence: references/cli-tools/cymbal.md contains the command irm https://raw.githubusercontent.com/1broseidon/cymbal/main/install.ps1 | iex.
[EXTERNAL_DOWNLOADS]: The skill frequently attempts to download and execute code or plugins from unverified third-party repositories and registries that are not associated with the author or trusted vendors.
Evidence: references/cli-tools/codequality-review.md references pi install git:github.com/cursor/plugins and npx skills add cursor/plugins -g.
Evidence: references/cli-tools/safe-change.md references pi install git:github.com/PriNova/pi-agent-codebase-workflows.
Evidence: references/cli-tools/agent_browser.md references npx -y @earendil-works/pi-agent-browser.
Evidence: references/cli-tools/subagents.md references @tintinweb/pi-subagents and pi-subagents from nicobailon.
[COMMAND_EXECUTION]: The skill uses subagent tools and bash to execute complex logic, including dynamic script generation via node -e to process project configurations.
Evidence: SKILL.md contains logic to run cymbal structure --json and pipe outputs to files which are later read to influence the shaping process.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project files and technical previews to drive the product shaping logic without adequate boundary markers or sanitization.
Ingestion points: stelow.json (workflow configuration), context/tech-preview.md (codebase analysis), context/blocking-constraints.md (previous cycle outputs), and context/existing-features.md (symbol search results).
Boundary markers: Absent. The skill reads these files directly into the context to inform shaping decisions.
Capability inventory: The skill has extensive capabilities including subagent delegation, bash command execution, and file writing/modification.
Sanitization: Partial. While it uses node to parse JSON configurations, other inputs like technical risks and existing feature summaries are consumed as raw text.
[DATA_EXFILTRATION]: While not directly exfiltrating credentials, the agent-browser tool is instructed to open local and remote URLs to capture snapshots and interactions, which could be leveraged to capture sensitive UI states if misconfigured.
Evidence: references/cli-tools/agent_browser.md documents the open --url "{URL}" -- snapshot -i command.

stelow-product-shape-up