cali-product-open-source

Warn

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the installation of various plugins from third-party sources. This includes repositories like PriNova/pi-agent-codebase-workflows and NPM packages such as @juicesharp/rpiv-todo and @backnotprop/plannotator. It also neutrally references plugins from Cursor's official GitHub repository.
  • [REMOTE_CODE_EXECUTION]: The skill is designed to run code provided by external extensions (safe-change, todo, intercom, pi-supervisor) after they are installed. The framework relies on these external scripts to perform core workflow functions.
  • [COMMAND_EXECUTION]: The goal and subagent systems (goals.md, subagents.md) involve the execution of arbitrary shell commands for task verification and execution, which are defined within task descriptions.
  • [PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. It ingests data from external URLs via agent_browser and performs external research using a researcher subagent. There are no documented sanitization procedures or boundary markers for this untrusted content, potentially allowing external data to influence agent behavior.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 3, 2026, 12:53 PM
Security Audit — agent-trust-hub — cali-product-open-source