find-skills
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
npx skillscommand-line interface to perform searches and manage package installations. - [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external code packages from GitHub and the
skills.shregistry. It specifically referencesvercel-labs/agent-skillsas a primary source for reliable skills. - [INDIRECT_PROMPT_INJECTION]: The skill interprets and displays search results (metadata and descriptions) from the external skills registry. This introduces a surface where malicious package metadata could attempt to influence the agent's instructions during the discovery process.
- Ingestion points: Results from the
npx skills findcommand as described inSKILL.md. - Boundary markers: Not explicitly defined for the external tool output.
- Capability inventory: Execution of shell commands and installation of global packages via
npx skills add. - Sanitization: Not specified for the external registry data.
Audit Metadata