library-skills
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill utilizes
npx library-skillsanduvx library-skillsto execute its management logic. These commands download and run the tool directly from the NPM and PyPI registries. - [COMMAND_EXECUTION]: The instructions direct the agent to run standard shell commands for project environment setup and maintenance, such as
npm install,bun install, anduv sync. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of tools and skill definitions from external package registries during its discovery and installation processes.
- [PROMPT_INJECTION]: The skill facilitates a surface for indirect prompt injection by scanning project dependencies for skills to install. Ingestion points: Scans
.agents/skillsdirectories within installed packages. Boundary markers: None identified for individual discovered skills. Capability inventory: Can install or symlink skills into the project's active skill directory. Sanitization: Relies on the user or agent to review discovered skills before installation.
Audit Metadata