The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx to run the skills utility, which executes code from the npm registry. It further allows the installation of remote packages from GitHub repositories, representing an execution vector for external code.
[EXTERNAL_DOWNLOADS]: Connects to skills.sh and various GitHub or git-hosted repositories to fetch package definitions and source code.
[COMMAND_EXECUTION]: Executes shell commands to manage the skill lifecycle, including npx skills find and npx skills add. The installation command includes the -y flag, which bypasses the user confirmation step.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted search results (names and descriptions) from a remote index, which could be manipulated to influence agent behavior.
Ingestion points: Command output processed from npx skills find.
Boundary markers: None; instructions do not provide delimiters or instructions to ignore embedded commands in search results.
Capability inventory: The skill has the capability to write to the file system and install/execute code via the skills add command.
Sanitization: No validation or sanitization of package metadata is performed before it is presented to the user or used in further operations.

find-skills