cali-product-scope-executor
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and instructs the installation of several external dependencies from unverified sources, including 'github.com/cursor/plugins', 'github.com/PriNova/pi-agent-codebase-workflows', and the NPM package '@juicesharp/rpiv-todo'. These are installed using tools like 'pi install' or 'npx skills add'.
- [COMMAND_EXECUTION]: The skill uses shell-based execution logic, including 'node -e' to dynamically process and update JSON tracking files. It also uses 'grep' and other shell utilities to extract configuration values (like 'appetite') from project files.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It reads project plans ('spec-tech.md') that contain 'Acceptance Criteria', 'Verify commands', and 'Objectives'. These fields are directly interpolated into the task descriptions sent to child agents (workers/subagents) without sanitization or boundary markers. A malicious plan file could influence subagent behavior or trigger unauthorized command execution through the 'verify' command field.
- Ingestion points: Reads plan data from 'docs/{YYYY-MM-DD}/{slug}/plans/spec-tech_{v}.md' and '.stelow//plans/spec-product.md'.
- Boundary markers: Absent; data is interpolated directly into strings.
- Capability inventory: Uses 'subagent' delegation, 'node -e' execution, and file system writes.
- Sanitization: None detected for the plan contents.
Audit Metadata