find-skill
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
npx skillscommands through PowerShell to ensure functionality in Windows environments where standard Bash shells may fail. This is a functional requirement for the skill's operation. Safety is ensured by clear instructions that require the agent to present the exact command and target (project vs. user scope) for user review and explicit approval before any execution. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for searching external skill repositories based on user requests. It explicitly mitigates the risk of prompt injection and data leakage by instructing the agent to sanitize inputs into 2-5 generic English keywords and strictly forbidding the inclusion of private prompt text, secrets, local paths, or internal identifiers in search queries.
Audit Metadata