skills/marcioaltoe/skills/find-skills/Gen Agent Trust Hub

find-skills

Warn

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill is designed to download and install external agent skills using the npx skills add command, which allows the execution of code from remote repositories.
  • [COMMAND_EXECUTION]: Instructions direct the agent to use the -y flag (e.g., npx skills add <package> -g -y), which explicitly skips user confirmation prompts during installation, enabling the autonomous installation of software.
  • [EXTERNAL_DOWNLOADS]: The skill references and fetches content from external sources including skills.sh and various GitHub repositories, such as those within the Vercel Labs organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local SKILL.md files and external search results from the npx skills find command. 1. Ingestion points: skills/**/SKILL.md, skills-registry.json, and CLI search output. 2. Boundary markers: None. 3. Capability inventory: Remote package installation and execution via npx. 4. Sanitization: None.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 21, 2026, 11:33 AM