The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and installs numerous third-party tools and plugins from unverified sources. Examples include the pi-agent-codebase-workflows from the PriNova GitHub repository, and several NPM packages such as @vedanth/context7, @juicesharp/rpiv-todo, @juicesharp/rpiv-ask-user-question, and various @plannotator extensions. The skill also downloads guidelines from Vercel Labs' public repository and tools from Cursor's GitHub repository, which are well-known services.
[REMOTE_CODE_EXECUTION]: The skill executes remote code at runtime via npx and pi install commands. It fetches and runs tools from unverified sources, such as npx @vedanth/context7 and plugins from github.com/PriNova/pi-agent-codebase-workflows. These operations execute scripts in the agent's environment from repositories outside the trusted list.
[COMMAND_EXECUTION]: Bash scripts in the SKILL.md file process data from potentially untrusted project files (spec-product.md). In the planning:10.5 section, the skill extracts lines from the product specification and passes them directly into shell commands as arguments (cymbal search --text "$line"), which could lead to command injection if the input is maliciously crafted.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes data from spec-product.md in high-capability contexts like subagent tasks and alignment checks. It lacks boundary markers or explicit instructions for the agent to ignore any instructions embedded within the processed text, creating a surface for data-driven attacks.

cali-product-tech-planning