find-skills

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to use npx skills find and npx skills add to interact with the agent skills ecosystem.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party agent extensions from external repositories, specifically referencing the vercel-labs organization on GitHub as an example source.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes search results and package descriptions which are retrieved from an external registry.
  • Ingestion points: Data returned by the npx skills find command, including skill names and descriptions.
  • Boundary markers: The instructions provide a structured template for presenting search results to the user, helping to distinguish third-party content.
  • Capability inventory: The skill possesses the ability to execute search and installation commands for software packages.
  • Sanitization: The instructions do not specify a validation or sanitization step for the metadata retrieved from the package search.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:44 PM