The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to fetch and install modular agent packages from external sources.
References the skills.sh registry for discovery.
Specifically suggests resources from Vercel Labs' GitHub repository.
[REMOTE_CODE_EXECUTION]: Facilitates the installation and execution of code via the npx skills add command.
The instructions direct the agent to use the -y flag, which suppresses confirmation prompts, potentially leading to the silent installation of remote code.
[COMMAND_EXECUTION]: Utilizes the skills CLI to perform system-level operations such as finding, adding, checking, and updating packages.
[PROMPT_INJECTION]: Contains a surface for indirect prompt injection where the agent processes and displays data from an external registry.
Ingestion points: Data returned from the npx skills find command (SKILL.md).
Boundary markers: None identified in the instructions to delimit external data.
Capability inventory: The skill has the ability to execute shell commands and install software via npx (SKILL.md).
Sanitization: There is no instruction to sanitize or validate the metadata or package names returned from the registry before presenting them to the user or executing commands.

find-skills