The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch and run the skills package manager from the npm registry.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and install modular agent capabilities from external GitHub repositories using the npx skills add command.
[COMMAND_EXECUTION]: The instructions specifically advise using the -y flag (e.g., npx skills add <package> -g -y) to suppress confirmation prompts, allowing the agent to install new executable code without explicit user approval.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface: 1. Ingestion points: Search results from the external npx skills find command are incorporated into the agent's context (SKILL.md). 2. Boundary markers: No delimiters or ignore-instructions are used when processing search results. 3. Capability inventory: The agent has the ability to execute code and install packages via npx (SKILL.md). 4. Sanitization: There is no evidence of validation or sanitization of the external package names or descriptions retrieved from the registry.

find-skills