find-skills

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the skills CLI via npx to perform search, installation, and update operations. Commands like npx skills find, npx skills add, and npx skills update allow the agent to interact with the package manager environment.
  • [EXTERNAL_DOWNLOADS]: Instructs the agent to fetch and install modular packages from external sources, primarily GitHub repositories. The instructions include a specific quality verification step (Step 4) directing the agent to check install counts, GitHub stars, and source reputation before proceeding with recommendations.
  • [PROMPT_INJECTION]: As an discovery tool, the skill ingests data from external search results and skill metadata which serves as a potential surface for indirect instructions. This is mitigated by explicit operational steps requiring the agent to validate the source.
  • Ingestion points: Results and metadata from the npx skills find command and the skills.sh leaderboard.
  • Boundary markers: Not explicitly defined in the CLI output processing.
  • Capability inventory: Capability to install and execute code via npx skills add and initialize new projects with npx skills init.
  • Sanitization: Employs reputation-based filtering and installation count thresholds as a primary validation mechanism.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 10:41 PM
Security Audit — agent-trust-hub — find-skills