cali-product-plan-critique
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires and provides instructions for the installation of several third-party tools and plugins from non-trusted community sources. These include repositories such as 'cursor/plugins' and 'PriNova/pi-agent-codebase-workflows', as well as NPM packages like '@juicesharp/rpiv-ask-user-question', 'pi-intercom', and '@juicesharp/rpiv-todo'.
- [REMOTE_CODE_EXECUTION]: Instructions for setting up the skill involve downloading code directly from community GitHub repositories and executing it through package managers like 'pi install' or 'npx'. This pattern facilitates the execution of unverifiable code from individual contributors.
- [COMMAND_EXECUTION]: The main skill logic in 'SKILL.md' uses bash shell commands to identify the active workflow directory and parse local JSON and markdown files using tools like 'grep', 'ls', and 'head'. While functional, this involves direct shell interaction with local file paths.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests the content of 'spec-product.md' (untrusted data) and interpolates it into prompts for subagents. There are no boundary markers or instructions to ignore embedded commands, allowing an attacker to potentially influence agent behavior through content in the product specification.
- [SAFE]: The identification of platform directories such as '
/.pi/', '/.claude/', and '~/.codex/' in 'references/cli-tools/README.md' is documented correctly as a method for detecting the current execution environment and does not involve sensitive data exfiltration.
Audit Metadata