The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run npx skills commands to search for and install packages. It specifically suggests using the -y flag, which bypasses user confirmation during the installation process.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of code from external GitHub repositories. It provides examples referencing well-known organizations like Vercel.
[PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection where user-provided search queries are interpolated into shell commands.
Ingestion points: User input is captured in the [query] placeholder within SKILL.md.
Boundary markers: No delimiters or safety instructions are provided to isolate the user-provided query from the command structure.
Capability inventory: The agent can execute npx skills find and npx skills add which involve network access and code installation.
Sanitization: No sanitization or validation logic is specified for the interpolated user input.

find-skills