find-skills
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use the
npx skillsCLI for searching, checking, and updating packages. It suggests using the-yand-gflags for autonomous installation. - [EXTERNAL_DOWNLOADS]: The primary purpose of the skill is to identify and install third-party code packages (skills) from external repositories into the environment.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where user-supplied queries are used to search an external registry. It mitigates the risk of discovering or installing malicious packages through explicit verification instructions (Step 4). Ingestion points: User queries in SKILL.md; Boundary markers: Not present in shell command templates; Capability inventory: Shell execution and package installation via
npx; Sanitization: Mandatory verification of install counts (>1k preferred), source reputation (official orgs preferred), and GitHub stars.
Audit Metadata