find-skills
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with an external marketplace API hosted on Alibaba Cloud (
wuyingai.cn-shanghai.aliyuncs.com) to retrieve skill listings and metadata via therequest.pyutility script. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (skill names, descriptions, and source URLs) from a remote API. This content is used to guide the agent's installation decisions, presenting a surface for tool output poisoning if the marketplace returns malicious data.
- [COMMAND_EXECUTION]: The skill generates commands for the agent to execute, specifically
npx skills add, which involves fetching and installing code from remote Git repositories.
Audit Metadata