The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute code from several third-party sources not recognized as trusted vendors. In references/cli-tools/agent_browser.md, it uses npx -y @earendil-works/pi-agent-browser to run a browser tool. In references/cli-tools/codequality-review.md and references/cli-tools/safe-change.md, it suggests installing plugins directly from GitHub repositories: git:github.com/cursor/plugins and git:github.com/PriNova/pi-agent-codebase-workflows.
[COMMAND_EXECUTION]: The configuration helper in references/cli-tools/read-config.md uses node -e to execute inline JavaScript strings for parsing stelow.json. Executing arbitrary code through the system runtime to handle local configuration files presents a dynamic execution risk.
[PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection (Category 8). It is designed to browse live websites and analyze source code directories using subagents. Malicious instructions embedded in the target website's HTML or the project's source code could manipulate the auditing subagent's behavior.
Ingestion points: SKILL.md (Live Site Audit mode), references/cli-tools/agent_browser.md.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided when passing the ingested content to subagents.
Capability inventory: The skill utilizes agent_browser for web access and subagents for task delegation, which can write files and execute further commands.
Sanitization: There is no evidence of filtering or escaping untrusted data before it is processed by the LLM subagents.

stelow-product-ux-critique