The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of external packages from GitHub and other remote repositories through the npx skills add command.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands (npx skills find, npx skills add) to manage software installation. It encourages the use of the -g flag for global installation, which modifies the user's environment beyond the local project directory.
[REMOTE_CODE_EXECUTION]: The core purpose of the skill is to install and run third-party code. Security risk is elevated by the recommendation to use the -y flag (npx skills add <package> -g -y), which suppresses interactive user confirmation, potentially allowing the agent to install and execute malicious remote code without explicit human oversight.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from an external registry via npx skills find and uses that data to determine which code to install. An attacker could publish a malicious skill with a deceptive name or description to influence the agent's selection and trigger an automated installation without sanitization or boundary markers.

find-skills