The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and installs multiple third-party packages and tools from external sources. These include repositories and npm scopes such as PriNova, tintinweb, juicesharp, nicobailon, and earendil-works. Specific examples include: npx -y @earendil-works/pi-agent-browser (agent_browser.md), pi install npm:@tintinweb/pi-tasks (todo.md), pi install git:github.com/PriNova/pi-agent-codebase-workflows (safe-change.md), and npx skills add cursor/plugins (codequality-review.md).- [REMOTE_CODE_EXECUTION]: Runtime execution of remote code is performed through npx -y and pi install git:... patterns. These methods download scripts or binaries from external providers and execute them directly on the host system without prior verification.- [COMMAND_EXECUTION]: Extensive shell command usage is documented throughout the skill for tasks like dependency analysis, test execution, and file locking. This includes the use of bash, find, grep, jq, and node -e. For example, read-config.md uses node -e to evaluate JavaScript for JSON parsing, and file-locking.md uses shell pipes and printf for atomic lock creation.- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) as it ingests untrusted data from spec-product.md and spec-tech.md (frontmatter fields like appetite, product_type, and scope) and interpolates them into subagent task descriptions and shell commands. Ingestion points: spec-product.md, spec-tech.md, and project files (detected via package.json, requirements.txt, etc.). Boundary markers: Absent; data is directly used in prompts and scripts. Capability inventory: Full bash access, file write/read capabilities, and subagent delegation tools. Sanitization: No evidence of validation or escaping for external content before interpolation.

stelow-product-testing-ai-code