skill-finder
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch the current marketplace assistant index from the vendor's official API at
https://zynkr.ai/api/skillsas a fallback mechanism. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and external index data to generate command-line recommendations, which creates a potential surface for indirect prompt injection.
- Ingestion points: User inquiry inputs and the assistant index (local file or API response).
- Boundary markers: No explicit delimiters are used to separate user data from the recommendation logic.
- Capability inventory: The skill generates
npx skills addcommands containing variables derived from the index. - Sanitization: There is no evidence of sanitization for strings retrieved from the index before they are placed into shell command templates.
- [COMMAND_EXECUTION]: The skill generates and displays shell commands (
npx skills add) to be executed by the user. These commands reference the author's official repository athttps://github.com/peter-tu-zynkr/zynkr-skill-builder.
Audit Metadata