find-skills
Warn
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to use
npx skills add <package>, which downloads and executes remote code from GitHub repositories to extend agent functionality. - [COMMAND_EXECUTION]: The instructions provide the agent with shell commands (
npx skills find,npx skills add,npx skills update) to manage software installation and updates. - [EXTERNAL_DOWNLOADS]: The skill facilitates network operations to fetch metadata and packages from
https://skills.sh/and various GitHub repositories, including those from trusted sources like Vercel Labs and third-party repositories. - [PROMPT_INJECTION]: The instructions explicitly tell the agent to use the
-yflag (npx skills add <owner/repo@skill> -g -y) when installing skills. This flag is designed to skip interactive confirmation prompts, allowing the agent to autonomously install and execute remote code without human review.
Audit Metadata