find-skills
Fail
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install and execute modular packages from external sources using
npx skills add <package>. Crucially, it encourages the use of the-yflag which explicitly skips user confirmation prompts, facilitating the automated installation and execution of untrusted code from arbitrary GitHub repositories. - [COMMAND_EXECUTION]: The core functionality of the skill relies on executing shell commands through the
npx skillsCLI tool to find, add, check, and update packages. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of content from the
skills.shregistry and various GitHub repositories. While the instructions provide examples from established organizations, the underlying mechanism allows the agent to fetch and install content from any user-specified remote source.
Recommendations
- AI detected serious security threats
Audit Metadata