The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of modular packages from external sources such as GitHub and the skills.sh registry using the npx skills add command.
[REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to install and execute code from remote repositories. It specifically encourages using the -y flag to skip confirmation prompts and the -g flag for global installation. This behavior allows for the silent execution of arbitrary code provided by third-party authors without user oversight.
[COMMAND_EXECUTION]: The skill relies on shell command execution via the npx utility to search for, install, and update local tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted search results from an external registry. If the registry or the package metadata contains malicious instructions, the agent may be misled into performing unauthorized actions or installing compromised packages.
Ingestion points: Search results returned by npx skills find and package descriptions.
Boundary markers: None identified; the agent is instructed to present the external content directly to the user or act upon it.
Capability inventory: File system access and package installation capabilities via the npx skills toolset.
Sanitization: No evidence of input validation or content filtering is provided before the agent interpolates search results into its responses or installation commands.

find-skills