The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the npx skills command to interact with an external ecosystem.
Evidence: npx skills find [query], npx skills add <package>, and npx skills add <owner/repo@skill> -g -y are used to manage local and global installations.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs software from external sources, including GitHub repositories.
Evidence: Uses npx skills add to fetch modular packages from the open agent skills ecosystem. It specifically references trusted sources such as Vercel Labs for configuration and guidelines.
[REMOTE_CODE_EXECUTION]: The installation process involves executing code downloaded from remote repositories via the npx utility.
Evidence: The skill instructions command the agent to run npx skills add <package> which triggers the download and execution of remote skill packages.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data returned from search results which could potentially contain malicious instructions.
Ingestion points: Results from the npx skills find [query] command are read into the agent's context (SKILL.md).
Boundary markers: None identified in the instructions for separating command output from agent instructions.
Capability inventory: The skill has the ability to execute shell commands (npx skills add) and perform global installations (-g -y).
Sanitization: There is no explicit sanitization or validation of the search results before the agent presents them to the user or acts upon them.

find-skills