cali-product-shape-up
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation in
references/cli-tools/cymbal.mdprovides an installation command for the 'cymbal' tool that uses a dangerous remote execution pattern:irm https://raw.githubusercontent.com/1broseidon/cymbal/main/install.ps1 | iex. This command downloads a script and executes it immediately via PowerShell without integrity verification. - [EXTERNAL_DOWNLOADS]: The skill encourages the installation of various external, unverified packages and plugins across multiple reference files, including
1broseidon/cymbal,cursor/plugins,nicobailon/pi-intercom,PriNova/pi-agent-codebase-workflows, and@juicesharp/rpiv-todo. These tools are not from the platform's trusted vendor list. - [COMMAND_EXECUTION]:
SKILL.mdcontains numerous shell command sequences used for environmental discovery and codebase analysis. It executes tools such ascymbal(cymbal index,cymbal structure,cymbal impact,cymbal search) and delegates tasks via thesubagenttool. The security of these operations depends on the integrity of the external tools being invoked. - [PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface in
SKILL.md. It reads content fromcontext/blocking-constraints.mdand project metadata files (index.json) and incorporates them directly into the agent's context without delimiters or sanitization. - Ingestion points:
context/blocking-constraints.md,.stelow/*/index.json, and various project manifest files. - Boundary markers: None identified for file content interpolation.
- Capability inventory: Subprocess execution (bash), codebase analysis tools (cymbal), subagent delegation, and interactive user prompts (ask).
- Sanitization: None for raw file reads; partial sanitization via regex (grep) for metadata extraction.
Audit Metadata