cali-product-open-source
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the installation of various plugins from third-party sources. This includes repositories like
PriNova/pi-agent-codebase-workflowsand NPM packages such as@juicesharp/rpiv-todoand@backnotprop/plannotator. It also neutrally references plugins from Cursor's official GitHub repository. - [REMOTE_CODE_EXECUTION]: The skill is designed to run code provided by external extensions (
safe-change,todo,intercom,pi-supervisor) after they are installed. The framework relies on these external scripts to perform core workflow functions. - [COMMAND_EXECUTION]: The goal and subagent systems (
goals.md,subagents.md) involve the execution of arbitrary shell commands for task verification and execution, which are defined within task descriptions. - [PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. It ingests data from external URLs via
agent_browserand performs external research using aresearchersubagent. There are no documented sanitization procedures or boundary markers for this untrusted content, potentially allowing external data to influence agent behavior.
Audit Metadata