The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to facilitate the installation and execution of external packages via the npx skills add command. This enables the agent to fetch code from remote sources, such as GitHub repositories, and integrate it into the agent environment.
[COMMAND_EXECUTION]: The skill provides specific instructions for executing CLI commands including npx skills find, npx skills add, npx skills check, and npx skills update. It encourages the use of the -y flag during installation to bypass user confirmation prompts, which is intended to streamline the agent's automation.
[EXTERNAL_DOWNLOADS]: The skill directs the agent to interact with https://skills.sh/ and mentions established organizations like Vercel Labs, Anthropic, and Microsoft as trusted sources for ecosystem packages.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where malicious instructions could be embedded in the metadata or descriptions of external skills returned by search results.
Ingestion points: CLI output from npx skills find and third-party skill metadata.
Boundary markers: None explicitly defined for delimiting tool output during processing.
Capability inventory: The skill has the ability to execute shell commands and install files to the system.
Sanitization: The skill incorporates a mandatory verification step (Step 4) that instructs the agent to manually validate the reputation of a skill (e.g., checking install counts and GitHub stars) before recommending it to the user.

find-skills