find-skills

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill leverages the npx skills command-line interface to perform searches and manage package installations.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external code packages from GitHub and the skills.sh registry. It specifically references vercel-labs/agent-skills as a primary source for reliable skills.
  • [INDIRECT_PROMPT_INJECTION]: The skill interprets and displays search results (metadata and descriptions) from the external skills registry. This introduces a surface where malicious package metadata could attempt to influence the agent's instructions during the discovery process.
  • Ingestion points: Results from the npx skills find command as described in SKILL.md.
  • Boundary markers: Not explicitly defined for the external tool output.
  • Capability inventory: Execution of shell commands and installation of global packages via npx skills add.
  • Sanitization: Not specified for the external registry data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 03:28 PM