find-skills
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the 'npx skills' CLI, specifically for 'find' and 'add' operations.
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading and installing remote packages from external sources using 'npx skills add', including packages from Vercel Labs' official GitHub repository.
- [INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface where untrusted data from search results could influence agent actions. * Ingestion points: The output of the 'npx skills find' command (SKILL.md). * Boundary markers: No delimiters or warnings are specified to isolate the external search results from the agent's instructions. * Capability inventory: The agent is instructed to execute 'npx skills add' which can download and execute remote code. * Sanitization: No sanitization or validation of the search result content is described before the agent acts upon it.
Audit Metadata