find-skills

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the npx skills command-line utility to interact with the skills ecosystem. This includes searching for packages and managing installations.
  • [EXTERNAL_DOWNLOADS]: The skill guides the agent to download and install external code packages from sources like GitHub via the npx skills add command. It specifically references well-known and trusted sources for best-practice guidelines.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection.
  • Ingestion points: Data enters the agent's context through the output of the npx skills find command, which fetches search results from external registries.
  • Boundary markers: Not explicitly defined for search result processing, though the workflow involves presenting options to the user before installation.
  • Capability inventory: The skill can execute shell commands via npx to install software (npx skills add).
  • Sanitization: The skill does not describe specific sanitization of external search results before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 07:04 PM