find-skills
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Utilizes the
npx skillsutility to interact with the agent ecosystem via shell commands for discovery and installation tasks.\n- [EXTERNAL_DOWNLOADS]: Facilitates the retrieval of agent skills from remote sources, including GitHub and the official skills registry.\n- [REMOTE_CODE_EXECUTION]: Supports the installation of third-party code packages which are integrated into the agent's functional environment.\n- [PROMPT_INJECTION]: Ingests search queries and metadata from the skills registry; this constitutes a potential surface for indirect prompt injection if malicious content is present in ecosystem metadata or if unsanitized user input is passed to the CLI tool.
Audit Metadata