The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation references multiple third-party plugins and packages from unverified sources that users are encouraged to install. This includes the cursor/plugins and PriNova/pi-agent-codebase-workflows GitHub repositories, as well as NPM packages such as @juicesharp/rpiv-todo, @juicesharp/rpiv-ask-user-question, @plannotator/pi-extension, @plannotator/opencode, and @backnotprop/plannotator. These sources do not belong to the skill author or recognized trusted vendors.
[REMOTE_CODE_EXECUTION]: Instructions to install plugins via pi install git:github.com/cursor/plugins and pi install git:github.com/PriNova/pi-agent-codebase-workflows involve downloading and executing code directly from external repositories. This pattern constitutes a supply chain risk where malicious code could be introduced into the agent's environment if these repositories are compromised.
[COMMAND_EXECUTION]: The workflow involves the use of several CLI-based tools (e.g., safe-change, plannotator, subagent, agent_browser) to perform tasks like code review, testing, and deployment. The security of these operations is dependent on the integrity of the unverified third-party code that implements these tools.
[PROMPT_INJECTION]: The skill architecture includes several surfaces for indirect prompt injection. For instance, the plannotator tool captures user-provided annotations and feeds them back into the LLM as structured feedback for revision. If these annotations are not properly sanitized, they could be used to inject instructions that alter the agent's intended behavior.

cali-product-marketplace-playbook