find-skills
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx, specificallynpx skills findandnpx skills addto interact with the skills ecosystem. - [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of external code from GitHub or other repositories via the
npx skills addcommand. - [REMOTE_CODE_EXECUTION]: Instructions encourage the use of the
-yflag, which bypasses user confirmation prompts during the installation process, and the-gflag for global installation. - [EXTERNAL_DOWNLOADS]: The skill references
https://skills.sh/as a source for browsing and downloading external skills. - [EXTERNAL_DOWNLOADS]: References resources from Vercel Labs' and Anthropic's official repositories.
- [PROMPT_INJECTION]: The skill processes untrusted search results and descriptions from external sources (Ingestion points). It lacks explicit boundary markers or instructions to ignore embedded commands in that data (Boundary markers). The agent has the capability to execute shell commands via
npx(Capability inventory). Sanitization is limited to manual reputation checks based on metadata (Sanitization).
Audit Metadata