The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install several third-party packages and scripts from sources that are not recognized as trusted or well-known vendors. These include:
npx -y @earendil-works/pi-agent-browser in references/cli-tools/agent_browser.md.
npx skills add Prinova/pi-agent-codebase-workflows and pi install git:github.com/PriNova/pi-agent-codebase-workflows in references/cli-tools/safe-change.md.
pi install npm:@tintinweb/pi-tasks and pi install npm:@juicesharp/rpiv-todo in references/cli-tools/todo.md.
pi-intercom by user nicobailon in references/cli-tools/intercom.md.
@tintinweb/pi-subagents and pi-subagents by user nicobailon in references/cli-tools/subagents.md.
pi-supervisor by user tintinweb in references/cli-tools/supervise.md.
[REMOTE_CODE_EXECUTION]: The skill executes remote code by invoking the previously mentioned untrusted packages via npx, pi install, or directly through bash commands after installation. This provides a direct path for executing arbitrary code from third-party repositories.
[DYNAMIC_EXECUTION]: The skill makes extensive use of node -e to dynamically parse and manipulate JSON configuration data (stelow.json) within shell scripts. This is found in SKILL.md, references/cli-tools/read-config.sh, and stages/setup.md. While used for configuration parsing, the use of dynamic string execution for logic is a notable behavior.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: Raw user input is parsed and grouped in the triage stage (stages/triage.md) and then propagated through the workflow.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying instructions embedded within this untrusted data.
Capability inventory: The skill possesses extensive capabilities across its stages, including file editing (edit), file writing (write), shell execution (bash), and automated browsing (agent_browser).
Sanitization: No sanitization or validation of user-supplied data is performed before it is passed to subagents or used to influence workflow logic.

stelow-workflow-orchestrator