find-skills

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill explicitly instructs the agent to use powershell -Command to execute shell operations. This is used to interact with the npx skills CLI for searching, installing, and listing skills. This behavior is documented as a necessary fix for Windows compatibility issues within the agent's environment.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of external code packages from the skills.sh registry (hosted via NPM) using the npx skills add command. The use of the -y flag in installation instructions allows the agent to bypass confirmation prompts for installing these external dependencies.
  • [DATA_EXPOSURE]: The skill handles user-provided search queries. While it suggests wrapping queries in single quotes within the PowerShell command to prevent interpolation, there is a minor risk of command injection if the underlying agent platform does not sanitize user input before passing it to the shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 01:10 AM
Security Audit — agent-trust-hub — find-skills