find-skills
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
npx skillsutility to perform package management tasks such as searching, adding, and updating skills. - [EXTERNAL_DOWNLOADS]: The
npx skills addcommand is used to download and install code from external sources like GitHub. The skill instructs the agent to mitigate risks by verifying source reputation and installation statistics, specifically referencing trusted entities like Anthropic and Vercel Labs. - [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection from search results provided by the CLI.
- Ingestion points: Data enters the agent context through the output of the
npx skills findcommand. - Boundary markers: The skill utilizes manual verification instructions rather than programmatic delimiters.
- Capability inventory: Includes the ability to download software and execute shell commands.
- Sanitization: The agent is directed to validate the source reputation and check for established metrics (e.g., install counts, GitHub stars) before proceeding with any installation.
Audit Metadata