The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the agentshq package from the npm registry at runtime.
[EXTERNAL_DOWNLOADS]: The add action allows fetching agent content from remote GitHub repositories or arbitrary URLs provided by the user.
[COMMAND_EXECUTION]: The skill executes multiple subcommands through npx agentshq (find, add, list, remove, check, update, init) using user-provided arguments such as search queries, repository names, and URLs.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the installation of third-party agent definitions which could contain malicious instructions designed to influence the behavior of the host agent.
Ingestion points: The npx agentshq add <owner>/<repo> and npx agentshq add <url> commands in SKILL.md ingest content from external, untrusted sources.
Boundary markers: Absent. The skill does not provide instructions to the agent to treat imported files as data only or to ignore embedded instructions.
Capability inventory: The skill has access to the Bash tool for command execution, the Read tool for file access, and the AskUserQuestion tool for interaction.
Sanitization: Absent. The skill instructions do not specify any validation, filtering, or sanitization of the downloaded agent content before it is translated and installed into the local environment.

find-agents