install-skills
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands (via
npx) to interact with a CLI tool for listing and adding agent skills to the local repository. - [EXTERNAL_DOWNLOADS]: The skill downloads the
skillspackage from the npm registry and fetches content from external sources such as GitHub repositories (e.g.,patinaproject/skills). - [SAFE]: The instructions explicitly include
npm_config_ignore_scripts=truewhen runningnpxcommands, which is a significant security control that prevents potentially malicious lifecycle scripts from running during the execution of the external package.
Audit Metadata