find-me-skills
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
asmCLI to interact with the local environment and a remote catalog. Specific commands includecommand -v asmfor prerequisite checking,asm searchfor discovery, andasm bundle showfor manifest validation. It also executesdate -u +%Y-%m-%dT%H:%M:%S.000Zto generate ISO-8601 timestamps for the bundle metadata. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data retrieved from an external, live catalog which is not under the immediate control of the skill itself.
- Ingestion points: In
SKILL.md(Step 3) andreferences/catalog-discovery.md, the agent is instructed to read JSON output fromasm search, specifically evaluating thedescriptionandinstallCommandfields of candidate skills. - Boundary markers: No explicit boundary markers or instructions to ignore instructions embedded within catalog descriptions are provided.
- Capability inventory: The skill possesses the capability to execute shell commands (
asm), write JSON files to the filesystem, and provide the user with a command to install the discovered remote code. - Sanitization: There is no evidence of sanitization or filtering of the text content retrieved from the catalog before it is used to generate the sequenced plan for the user.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations via the
asmtool to fetch catalog data and facilitates the installation of remote skills using theasm bundle installcommand.
Audit Metadata