find-skills
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands using the
npx skillsutility to search for, install, and update agent packages. - [EXTERNAL_DOWNLOADS]: The skill fetches data and packages from the
skills.shregistry and GitHub repositories. It highlights content from well-known organizations such as Vercel Labs and Anthropic as examples of high-quality, trusted sources. - [REMOTE_CODE_EXECUTION]: The skill enables the installation of external agent skills via the
npx skills addcommand. These packages can contain code or instructions that execute within the agent's context. The instructions suggest using the-yflag to automate installation by skipping manual confirmation prompts. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from search results (e.g., skill names and descriptions) sourced from the external package registry. To mitigate the risk of processing malicious metadata, the instructions require the agent to verify install counts, source reputation, and GitHub star counts before recommending or installing any package.
Audit Metadata