cali-product-testing-execution
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions and commands to install several external dependencies and plugins from third-party GitHub repositories and registries. Examples include
github.com/cursor/pluginsfor code quality reviews andgithub.com/PriNova/pi-agent-codebase-workflowsfor regression checks. - [COMMAND_EXECUTION]: The protocol involves executing arbitrary shell commands to run project test suites (e.g.,
go test ./...,npm test,pytest) and interacting with various CLI tools likeplannotator,safe-change, andagent_browser. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch and install remote packages using platform-specific commands such as
pi installandnpx skills add, which results in the execution of code from external sources (e.g.,@plannotator/pi-extension,nicobailon/pi-intercom). - [PROMPT_INJECTION]: The skill contains instructional markers and decision trees (e.g., '⚠️ E2E-first', '⚠️ IMPORTANT'). These are assessed as benign natural instructional language intended to guide the agent's workflow rather than malicious overrides.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by ingesting and acting upon untrusted data.
- Ingestion points: Project source code is read for analysis (SKILL.md), and output is gathered from parallel subagents (subagents.md).
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the ingested code or subagent outputs.
- Capability inventory: The skill has access to shell command execution (
npm test,go test), browser automation (agent_browser), and subagent delegation. - Sanitization: There is no mention of sanitization or validation of the content processed from the codebase or external tools.
Audit Metadata