The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent on how to download and install external code packages using the npx skills add <package> command. This allows the agent to fetch and integrate modular packages from remote sources like GitHub into its environment.
[COMMAND_EXECUTION]: The skill provides a set of shell commands for the agent to execute, including searching for and adding packages. It explicitly recommends the use of the -y flag when installing (npx skills add <package> -g -y), which is designed to skip user confirmation prompts, potentially leading to the silent installation of third-party code.
[EXTERNAL_DOWNLOADS]: The skill facilitates fetching data and code from the skills.sh ecosystem and various GitHub repositories. While it mentions trusted organizations such as Vercel Labs as examples of sources, the mechanism allows for installation from any accessible repository.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing external data from a package registry.
Ingestion points: Results and descriptions returned by the npx skills find [query] command from the external skills.sh registry (SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within the search results are provided.
Capability inventory: The agent has the ability to execute shell commands and install new software packages (SKILL.md).
Sanitization: There are no instructions for sanitizing or validating the output from the registry before it is presented to the user or used for installation.

find-skills