skills/rmsite/skills/find-skills/Gen Agent Trust Hub

find-skills

Fail

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of arbitrary code from remote repositories using the npx skills add <package> command. This allows the agent to fetch and run external scripts that have not been vetted.- [COMMAND_EXECUTION]: The instructions provide the agent with specific shell commands to execute locally, including searching for packages (npx skills find) and installing them (npx skills add).- [EXTERNAL_DOWNLOADS]: The skill relies on an external registry at skills.sh and downloads content from various remote sources, including GitHub repositories.- [PROMPT_INJECTION]: The skill explicitly instructs the agent to use the -y flag when installing packages, which is designed to skip confirmation prompts. This reduces user oversight and allows the agent to modify the system environment or install potentially malicious software without explicit user consent.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 27, 2026, 12:14 PM