stelow-product-trust-building
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references and provides installation instructions for several third-party tools and plugins from unverifiable sources outside the trusted vendor list, including
github.com/cursor/plugins,github.com/PriNova/pi-agent-codebase-workflows, and various NPM packages like@earendil-works/pi-agent-browserand@tintinweb/pi-tasks. - [COMMAND_EXECUTION]: The 'Execution Loop Protocol' described in
execution-loop.mdandgoals.mdoutlines a process where the agent reads 'verify commands' from acheckpoint.jsonfile and executes them directly in the shell. Since these commands are derived from project-level specification files (spec-tech.md), this mechanism allows for arbitrary command execution guided by external data. - [PROMPT_INJECTION]: The skill acts as an orchestrator that ingests and processes various project artifacts such as
spec-product.md,stelow.json, andchecklist.md. This creates a surface for indirect prompt injection, where instructions embedded within these files could manipulate the agent's workflow or bypass safety guidelines. - [REMOTE_CODE_EXECUTION]: The instructions recommend using
npxto execute code from@earendil-works/pi-agent-browserandcursor/plugins, which involves fetching and running code from remote repositories at runtime.
Audit Metadata