The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the npx runner to execute the skills CLI tool for searching, checking, and updating packages. It specifically uses the npx skills add <package> -g -y command which enables the installation of external code with flags that bypass confirmation prompts.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs third-party capabilities from external repositories, including github.com and the skills.sh registry. It references repositories from well-known sources such as Vercel Labs, Anthropics, and Microsoft.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from search results returned by the npx skills find command, which could be manipulated by third parties to include malicious instructions in skill names or descriptions.
Ingestion points: Search results and metadata returned by the npx skills find [query] command in SKILL.md.
Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore instructions' directives when the agent reviews search results.
Capability inventory: The skill can execute shell commands via npx and write to the global file system during installation via the -g flag.
Sanitization: The skill relies on manual verification heuristics (such as install counts and source reputation) rather than automated content sanitization.
[PERSISTENCE]: The skill supports the global installation of modular packages (npx skills add -g), which creates persistent capabilities that remain available across agent sessions.

find-skills