find-skills
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to use
powershell -Commandto execute shell operations. This is used to interact with thenpx skillsCLI for searching, installing, and listing skills. This behavior is documented as a necessary fix for Windows compatibility issues within the agent's environment. - [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external code packages from the
skills.shregistry (hosted via NPM) using thenpx skills addcommand. The use of the-yflag in installation instructions allows the agent to bypass confirmation prompts for installing these external dependencies. - [DATA_EXPOSURE]: The skill handles user-provided search queries. While it suggests wrapping queries in single quotes within the PowerShell command to prevent interpolation, there is a minor risk of command injection if the underlying agent platform does not sanitize user input before passing it to the shell.
Audit Metadata