find-skills
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
npx skillsutility to search for, check, and update packages. Evidence:npx skills find [query],npx skills check,npx skills updateinSKILL.md. - [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of external code via the
npx skills addcommand, which downloads and executes packages from remote sources like GitHub or NPM. While it includes flags to bypass user confirmation (-y), it provides instructions to prioritize packages from trusted organizations to minimize risk. Evidence:npx skills add <owner/repo@skill> -g -yinSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes and displays data from an external search service (
skills.sh). Malicious package metadata could potentially influence agent behavior during the discovery phase. The skill mitigates this by requiring the agent to perform secondary validation of install counts and source reputation. Evidence: Step 3 and Step 4 inSKILL.mddescribe processing search results and verifying quality before recommendation.
Audit Metadata