The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run the npx command-line tool to search for and install packages. Evidence: The use of npx skills find and npx skills add commands within the SKILL.md file.
[REMOTE_CODE_EXECUTION]: The skill provides instructions for downloading and installing executable packages from external repositories, which allows for remote code execution upon installation. Evidence: The npx skills add <package> -g -y command downloads external code into the user's environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external search results which could be used to inject malicious instructions. Ingestion points: Output from the npx skills find command in SKILL.md. Boundary markers: Absent; no specific delimiters or warnings are provided for handling search output. Capability inventory: Shell command execution and software installation capabilities. Sanitization: Absent; the skill does not include steps to sanitize or validate the search results before presenting them to the user.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from external repositories, including a recommendation to browse tools at a specialized domain. Evidence: References to https://skills.sh/ and external package sources like vercel-labs/agent-skills (a well-known service) and ComposioHQ/awesome-claude-skills.

find-skills