find-skills
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external agent skills from the
skills.shregistry and GitHub repositories. - [REMOTE_CODE_EXECUTION]: The core purpose of the skill is to install and execute third-party code. To mitigate risks, it provides the agent with verification criteria, such as checking for high install counts and prioritizing official sources from well-known organizations.
- [COMMAND_EXECUTION]: The skill utilizes shell commands (
npx skills find,npx skills add) to manage the agent's extended capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search results.
- Ingestion points: Search results from the
npx skills findcommand. - Boundary markers: None explicitly defined for the search output.
- Capability inventory: Shell command execution via the
npx skills addcommand. - Sanitization: The instructions mandate a manual verification step (Step 4) where the agent must evaluate the source reputation and install metrics of a skill before presenting it to the user.
Audit Metadata