sub-agent

SUSPICIOUS/VULNERABLE rather than malicious. The skill’s capabilities broadly match its purpose, but that purpose is itself high-impact: spawning external coding agents with broad tool access, reduced approval modes, and the ability to act on untrusted PR content. Main risks are indirect prompt injection and delegated autonomy, plus moderate supply-chain exposure from third-party CLIs—especially the weaker-provenance Pi package. No clear credential theft, exfiltration endpoint, or hidden behavior is present.