find-skills
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use the Skills CLI (
npx skills) to search for, add, and update packages via the terminal. - [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of external code from GitHub and other sources using
npx skills add. It specifically notes the use of the-yflag, which skips confirmation prompts during installation. - [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch configuration and leaderboard data from
skills.shand to download packages from remote repositories. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided queries to search the skill ecosystem. Ingestion points: User requests for capabilities (e.g., 'how do I do X'). Boundary markers: None specified. Capability inventory: Terminal execution of the Skills CLI. Sanitization: The skill includes a dedicated 'Verify Quality' step (Step 4) that instructs the agent to check install counts, source reputation (citing specific trusted organizations), and GitHub stars to mitigate the risk of installing malicious content.
Audit Metadata