find-skills

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external agent skills from the skills.sh registry and GitHub repositories.
  • [REMOTE_CODE_EXECUTION]: The core purpose of the skill is to install and execute third-party code. To mitigate risks, it provides the agent with verification criteria, such as checking for high install counts and prioritizing official sources from well-known organizations.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands (npx skills find, npx skills add) to manage the agent's extended capabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search results.
  • Ingestion points: Search results from the npx skills find command.
  • Boundary markers: None explicitly defined for the search output.
  • Capability inventory: Shell command execution via the npx skills add command.
  • Sanitization: The instructions mandate a manual verification step (Step 4) where the agent must evaluate the source reputation and install metrics of a skill before presenting it to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 04:52 PM