find-skills

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using npx. Specifically, npx skills find searches for external packages, and npx skills add installs them. These commands are part of the intended functionality for skill discovery and management in the skills.sh ecosystem.
  • [EXTERNAL_DOWNLOADS]: The workflow involves fetching metadata and code from external sources such as the npm registry and GitHub. The skill includes built-in risk mitigation by enforcing 'Quality Thresholds,' requiring the agent to prioritize high installation counts (1K+) and trusted organizations like Microsoft, Anthropics, and Vercel. It also warns against installing skills from unknown or inactive repositories.
  • [REMOTE_CODE_EXECUTION]: The npx skills add command is used to install external code into the agent's environment. While this is a high-privilege operation, the skill explicitly provides guidelines to avoid unknown or low-quality sources and includes 'Anti-patterns' to prevent the agent from recommending unsafe or unverified software.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 11:54 AM