find-skills
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
npx skillsCLI to perform package management tasks, including searching, installing, and updating skills. - [EXTERNAL_DOWNLOADS]: It facilitates fetching code and metadata from external sources like GitHub and the
skills.shregistry. - [REMOTE_CODE_EXECUTION]: The skill automates the installation and execution of external code using the
npx skills addcommand, specifically highlighting the use of the-yflag to bypass user confirmation. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by processing untrusted search results from the package registry. Malicious package metadata could potentially influence agent behavior when the search output is interpreted to generate installation commands or descriptions.
Audit Metadata