stelow-product-testing-execution
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs multiple third-party extensions and CLI tools from unverified repositories. For example, agent_browser.md downloads @earendil-works/pi-agent-browser via npx, and safe-change.md instructs the agent to install Prinova/pi-agent-codebase-workflows.- [REMOTE_CODE_EXECUTION]: The protocol utilizes npx with the -y flag to execute remote packages (e.g., @earendil-works/pi-agent-browser in agent_browser.md) and pi install git commands to pull and run code from external GitHub repositories (e.g., cursor/plugins, PriNova/pi-agent-codebase-workflows). The -y flag allows for silent execution without user review.- [COMMAND_EXECUTION]: The skill performs various shell operations including running project test suites (go test, npm test, pytest) and using system utilities (jq, node, mkdir, ln, rm) to manage workflow state, file locking, and checkpoints.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes external code and live web content. Ingestion points include reading source code for audits (Phase 2) and visiting live URLs via agent-browser. There are no boundary markers or instructions to treat external data as untrusted, and the skill possesses powerful capabilities like bash and npx without evidence of input sanitization.
Audit Metadata