The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of external packages from remote repositories via the npx skills add command.
[REMOTE_CODE_EXECUTION]: Provides instructions for the agent to install and execute code from an external ecosystem. It specifically suggests using the -y flag with npx skills add, which bypasses user confirmation prompts and could lead to the silent installation of unverified software.
[COMMAND_EXECUTION]: Uses subprocess calls to execute shell commands including npx skills find, npx skills add, and npx skills init to manage external skills.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon data from an external search service (npx skills find). Because these search results originate from an open ecosystem, they could be crafted to include misleading instructions or exploit the agent's capability to install packages.
Ingestion points: Results from the npx skills find [query] command in SKILL.md.
Boundary markers: None identified.
Capability inventory: Package installation and code execution via npx skills add.
Sanitization: No evidence of output sanitization or validation of search results before presentation or installation.

find-skills