The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the npx skills CLI. This includes search operations (npx skills find) and installation operations (npx skills add). The documentation specifically mentions the -y flag to skip interactive confirmation prompts, which increases the risk of automated installation of malicious packages.
[REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to install external code packages from GitHub or other sources into the local environment (~/.codex/skills or ~/.agents/skills). Once installed, these skills can execute arbitrary code within the agent's runtime context.
[EXTERNAL_DOWNLOADS]: The skill facilitates fetching external code and configuration from the public skills.sh ecosystem and GitHub repositories. While it recommends official sources, the mechanism allows the installation of unverifiable code from any author.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external search index. An attacker could publish a malicious skill with a description designed to exploit the agent's interpretation, potentially tricking it into recommending or auto-installing a compromised package.
Ingestion points: Ecosystem search results retrieved via npx skills find (SKILL.md).
Boundary markers: None explicitly implemented in the commands, though instructions advise the agent to "present options to the user."
Capability inventory: The skill has shell execution capabilities via npx and the ability to modify the agent's filesystem and tools via npx skills add.
Sanitization: No technical sanitization of search result metadata is mentioned before the agent processes and presents it to the user.

find-skills