The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the npx skills CLI tool. This includes searching for packages and adding them to the system based on user-provided input, which could lead to command injection if input is not properly handled.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading software packages from external repositories, specifically from skills.sh and various GitHub repositories. This introduces risks associated with third-party code and supply chain security, as these sources are not restricted to trusted registries.
[REMOTE_CODE_EXECUTION]: The npx skills add command is used to install and potentially execute remote code. The skill explicitly recommends using the -y flag to skip user confirmation prompts and the -g flag for global installation, which reduces user oversight and increases the potential impact of a malicious package.

find-skills