The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent and user to install several third-party tools from unverified GitHub and NPM sources that are not part of the trusted vendor list. These include @earendil-works/pi-agent-browser, PriNova/pi-agent-codebase-workflows, and packages by tintinweb and nicobailon.
[REMOTE_CODE_EXECUTION]: The skill uses npx -y and pi install commands to dynamically download and execute code from remote registries. This pattern is used for the agent-browser tool and various plugins, allowing for the execution of external code without integrity verification.
[COMMAND_EXECUTION]: The skill performs complex state management by dynamically generating and executing shell commands and Node.js scripts. These scripts read and write to the stelow.json configuration file and manipulate project artifacts using the bash and write tools.
[PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it processes untrusted user input from an inbox (.stelow/inbox/items.md) and session knowledge files. This data is interpolated into prompts for subagents that have powerful capabilities like shell access (bash) and file modification.
Ingestion points: Inbox items, user requests in triage.md, and session knowledge in setup.md.
Boundary markers: The skill does not consistently use explicit boundary markers or 'ignore' instructions when processing this untrusted content.
Capability inventory: Subagents and the primary skill have access to bash, subagent, write, edit, and agent_browser.
Sanitization: The workflow relies on manual visual_review gates rather than technical sanitization or filtering of external content.

stelow-product-orchestrator