find-skills
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of code packages from remote repositories through the
npx skills addcommand. This pattern allows for the retrieval and execution of arbitrary scripts and executables from GitHub and other external sources. - [COMMAND_EXECUTION]: The skill instructs the agent to use the
-yflag with installation commands, which bypasses confirmation prompts and allows for the unattended installation of remote software packages. - [COMMAND_EXECUTION]: Instructions recommend global installation (
-g) of retrieved skills, which places third-party code into a system-wide or user-level directory with persistent execution potential. - [EXTERNAL_DOWNLOADS]: The skill fetches leaderboard information and package metadata from the
skills.shdomain and the npm registry to identify installable modules. - [REMOTE_CODE_EXECUTION]: The use of
npx skillstriggers the download and immediate execution of theskillsutility from the public npm registry if it is not already present on the local system.
Audit Metadata