skill-discovery
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides commands to download and install content from external GitHub repositories via the
npx skills addcommand. While it mentions trusted sources like Vercel Labs, the core functionality allows the agent to pull in code from any arbitrary repository listed in the marketplace. - [REMOTE_CODE_EXECUTION]: The workflow involves fetching and executing remote scripts from community sources. The documentation explicitly instructs the agent to use the
--yesflag to skip interactive prompts (e.g.,npx skills add owner/repo@skill --yes), which removes human review from the installation of executable code. - [COMMAND_EXECUTION]: The skill uses the
npxutility to execute shell commands for discovering and managing tools. These commands perform system-level operations, such as creating symlinks and installing files into the user's home directory at~/.agents/skills/.
Audit Metadata