The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the npx skills CLI to perform environment operations, including searching for packages (find), checking for updates (check), and installing new capabilities (add).
[EXTERNAL_DOWNLOADS]: The skill facilitates fetching external code and configurations from the skills.sh registry and various GitHub repositories. It specifically mentions repositories from Vercel Labs as a source for these downloads.
[REMOTE_CODE_EXECUTION]: The npx skills add command facilitates the installation and integration of third-party code into the agent's environment. The instructions mention the -y flag, which enables automatic installation by skipping manual confirmation prompts.
[INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection by ingesting external data from the npx skills find command. Maliciously crafted package metadata in the registry could potentially influence the agent's behavior during the search and presentation process.
Ingestion points: Search results from the npx skills find command as described in SKILL.md.
Boundary markers: The skill instructions advise the agent to present options to the user before installation, serving as a manual review step.
Capability inventory: The skill has the capability to write to the filesystem and execute new code through the installation of extensions.
Sanitization: No programmatic sanitization or validation of external search results is specified.
[DYNAMIC_EXECUTION]: The skill enables the dynamic extension of the agent's functionality by downloading and loading new tools, templates, and workflows into the operational environment at runtime.

find-skills