find-skills
Fail
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of arbitrary code from remote repositories using the
npx skills add <package>command. This allows the agent to fetch and run external scripts that have not been vetted.- [COMMAND_EXECUTION]: The instructions provide the agent with specific shell commands to execute locally, including searching for packages (npx skills find) and installing them (npx skills add).- [EXTERNAL_DOWNLOADS]: The skill relies on an external registry atskills.shand downloads content from various remote sources, including GitHub repositories.- [PROMPT_INJECTION]: The skill explicitly instructs the agent to use the-yflag when installing packages, which is designed to skip confirmation prompts. This reduces user oversight and allows the agent to modify the system environment or install potentially malicious software without explicit user consent.
Recommendations
- AI detected serious security threats
Audit Metadata