find-skills
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
skillsCLI vianpxto perform search, installation, and update operations. Commands likenpx skills find,npx skills add, andnpx skills updateallow the agent to interact with the package manager environment. - [EXTERNAL_DOWNLOADS]: Instructs the agent to fetch and install modular packages from external sources, primarily GitHub repositories. The instructions include a specific quality verification step (Step 4) directing the agent to check install counts, GitHub stars, and source reputation before proceeding with recommendations.
- [PROMPT_INJECTION]: As an discovery tool, the skill ingests data from external search results and skill metadata which serves as a potential surface for indirect instructions. This is mitigated by explicit operational steps requiring the agent to validate the source.
- Ingestion points: Results and metadata from the
npx skills findcommand and the skills.sh leaderboard. - Boundary markers: Not explicitly defined in the CLI output processing.
- Capability inventory: Capability to install and execute code via
npx skills addand initialize new projects withnpx skills init. - Sanitization: Employs reputation-based filtering and installation count thresholds as a primary validation mechanism.
Audit Metadata