skills/timblazing/skills/find-skills/Gen Agent Trust Hub

find-skills

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing the npx skills CLI tool to perform various tasks including searching for skills, checking for updates, and managing installations.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of modular code packages from external sources like GitHub and the skills.sh registry.\n- [EXTERNAL_DOWNLOADS]: Mentions fetching and installing guidelines and tools from well-known and reputable organizations such as Vercel Labs and Anthropic.\n- [PROMPT_INJECTION]: The skill searches an external registry (skills.sh) for third-party skills, creating an attack surface where malicious skill metadata could potentially influence agent behavior (Indirect Prompt Injection).\n
  • Ingestion points: Search results from the npx skills find command enter the agent's context.\n
  • Boundary markers: None provided in the search output processing instructions.\n
  • Capability inventory: Subprocess execution capability through the npx skills add command.\n
  • Sanitization: Instructions rely on manual verification steps rather than automated sanitization of search results.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 05:54 PM