Skills
Navigate
skills/calionauta/stelow/cali-product-health/Gen Agent Trust Hub

cali-product-health

Warn

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The reference file references/cli-tools/codequality-review.md provides instructions to install the cursor/plugins package from a third-party GitHub repository (github.com/cursor/plugins).
  • [EXTERNAL_DOWNLOADS]: The reference file references/cli-tools/safe-change.md provides instructions to install the pi-agent-codebase-workflows package from a third-party GitHub repository (github.com/PriNova/pi-agent-codebase-workflows).
  • [EXTERNAL_DOWNLOADS]: The reference file references/cli-tools/todo.md provides instructions to install the @juicesharp/rpiv-todo package from the NPM registry.
  • [EXTERNAL_DOWNLOADS]: The reference file references/cli-tools/plannotator.md references multiple unverified external packages, including @plannotator/pi-extension, @plannotator/opencode, and @backnotprop/plannotator.
  • [REMOTE_CODE_EXECUTION]: Multiple reference files within the skill, such as codequality-review.md, safe-change.md, and todo.md, provide specific shell commands (e.g., pi install and npx skills add) that instruct the agent to download and install executable code from unverified third-party sources, posing a supply chain and remote execution risk.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 3, 2026, 12:54 PM
Security Audit — agent-trust-hub — cali-product-health