The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute npx skills find [query] using queries directly derived from user input. This pattern creates a command injection risk if the user input contains shell metacharacters that are not properly sanitized before execution.
[REMOTE_CODE_EXECUTION]: In Step 6, the skill explicitly provides the command npx skills add <owner/repo@skill> -g -y and notes that the -y flag is used to skip confirmation prompts. This enables the silent installation and execution of arbitrary third-party code from the internet, bypassing a critical user-controlled safety checkpoint.
[EXTERNAL_DOWNLOADS]: The skill is designed to download and install packages from external, potentially untrusted sources (GitHub and npm). While it provides guidelines for verifying reputation (stars, installs), the automated nature of the suggested installation process remains a security concern.
[PROMPT_INJECTION]: This skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: The agent reads and processes output from the npx skills find tool (SKILL.md).
Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded in the search results or package descriptions.
Capability inventory: The agent has the capability to execute shell commands and install software via the npx skills add command.
Sanitization: There is no programmatic sanitization of the tool output; the skill relies on the agent's manual verification of metadata (stars, installs) which can be spoofed by an attacker.

find-skills