The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: In references/runtime.md, the skill directs users to install the pi-subagents package from a public registry. This dependency is not associated with a trusted vendor or the skill author, representing a potential supply chain vulnerability.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture ingests external data to generate briefs for sub-agents, which can lead to indirect injection attacks.\n
Ingestion points: Data is ingested via the tasks[], context, and STANDING fields in SKILL.md.\n
Boundary markers: Although a structured JSON format is used for tasks, the instructions lack explicit boundary markers to separate data from commands.\n
Capability inventory: The agents have significant capabilities, including file modification and command execution.\n
Sanitization: There are no instructions for sanitizing or escaping content before it is processed by sub-agents.\n- [COMMAND_EXECUTION]: The VERIFY section of the task contract specifies the execution of arbitrary shell commands. Because these commands are sourced from task briefs that can include untrusted data, this presents a risk of unauthorized command execution.

pstack-pi