skills/mxyhi/ok-skills/find-skills/Gen Agent Trust Hub

find-skills

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands using the npx skills utility to search for, install, and update agent packages.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data and packages from the skills.sh registry and GitHub repositories. It highlights content from well-known organizations such as Vercel Labs and Anthropic as examples of high-quality, trusted sources.
  • [REMOTE_CODE_EXECUTION]: The skill enables the installation of external agent skills via the npx skills add command. These packages can contain code or instructions that execute within the agent's context. The instructions suggest using the -y flag to automate installation by skipping manual confirmation prompts.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from search results (e.g., skill names and descriptions) sourced from the external package registry. To mitigate the risk of processing malicious metadata, the instructions require the agent to verify install counts, source reputation, and GitHub star counts before recommending or installing any package.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 08:00 AM