The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the npx skills utility to search for, install, and update packages. This includes using the -y flag to automate the process by bypassing manual confirmation prompts.
[REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to facilitate the installation of external agent code (skills) from GitHub or other remote sources. To mitigate the risks associated with third-party code, the instructions provide a verification framework (Step 4) that evaluates metrics like install counts, contributor reputation, and GitHub stars.
[EXTERNAL_DOWNLOADS]: The skill references the skills.sh platform and GitHub repositories for fetching package information and performing installations.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where user-provided strings (the search queries) are interpolated into shell commands.
Ingestion points: User queries for tasks or functionality searches in SKILL.md.
Boundary markers: Absent from the command templates.
Capability inventory: Subprocess calls via npx skills as documented in SKILL.md.
Sanitization: There are no specific instructions for the agent to sanitize or escape user-provided queries before they are passed to the command line.

find-skills