The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides and encourages the use of shell commands through the npx skills utility. Specifically, it recommends the add command with the -y flag, which suppresses confirmation prompts, and the -g flag for global installation, potentially increasing the impact of installing a malicious package.
[EXTERNAL_DOWNLOADS]: The primary function of the skill is to facilitate the download and installation of third-party code from external sources (such as GitHub) into the agent's environment via the npx skills add command.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted user requests to perform task decomposition and keyword generation without sanitization or boundary markers.
Ingestion points: User-provided task descriptions and project constraints processed in Phase 1 (Task Decomposition) and Phase 2 (Precision-Focused Search) of the pipeline in SKILL.md.
Boundary markers: None. The instructions direct the agent to extract user constraints verbatim and weave them into intent statements for searching.
Capability inventory: The skill uses npx skills find to query external repositories and npx skills add to install third-party packages.
Sanitization: None present. The agent is instructed to use the user's raw terminology to ensure search precision, which could lead to processing malicious instructions embedded in the task description.

find-skills-combo