find-skills
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx. Specifically,npx skills findsearches for external packages, andnpx skills addinstalls them. These commands are part of the intended functionality for skill discovery and management in theskills.shecosystem. - [EXTERNAL_DOWNLOADS]: The workflow involves fetching metadata and code from external sources such as the npm registry and GitHub. The skill includes built-in risk mitigation by enforcing 'Quality Thresholds,' requiring the agent to prioritize high installation counts (1K+) and trusted organizations like Microsoft, Anthropics, and Vercel. It also warns against installing skills from unknown or inactive repositories.
- [REMOTE_CODE_EXECUTION]: The
npx skills addcommand is used to install external code into the agent's environment. While this is a high-privilege operation, the skill explicitly provides guidelines to avoid unknown or low-quality sources and includes 'Anti-patterns' to prevent the agent from recommending unsafe or unverified software.
Audit Metadata