cali-product-testing-ai-code
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides installation instructions for several third-party tools and plugins from non-trusted GitHub repositories and NPM registries. Examples include
github.com/cursor/plugins,github.com/PriNova/pi-agent-codebase-workflows, and various packages from users such as@juicesharp,nicobailon, andtintinweb(e.g.,pi-intercom,pi-subagents,pi-supervisor). - [COMMAND_EXECUTION]: The skill provides various shell command templates for the agent to use during the testing process. These include file system traversal, content searching with
rg, and test runner execution (e.g.,find . -path ./node_modules -prune -o -name "*.test.*" -print | xargs rg -l "module_name" > affected_tests.txt). - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. It ingests data from untrusted external sources, including
spec-product.md,spec-tech.md, and project files likepackage.jsonorrequirements.txt. - Ingestion points:
SKILL.mdreads configuration and tech stack details from these files to determine testing breadth and tools. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The skill can generate and suggest the execution of shell commands, subagent tasks, and browser interactions based on the ingested data.
- Sanitization: No explicit sanitization or validation of the content extracted from project files is mentioned before it is used to formulate strategy and commands.
Audit Metadata