The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The skill facilitates the discovery and installation of external tools from third-party GitHub repositories via the npx add-skill command.
Evidence: src/commands/recommend.ts builds installation scripts using github_url metadata returned from the YouSkill API.
[REMOTE_CODE_EXECUTION] (MEDIUM): The primary output of the skill recommends that the user or agent execute shell commands (npx add-skill) derived from a remote API.
Evidence: The recommend command displays executable install strings for skills hosted on external repositories (e.g., npx add-skill https://github.com/davidcjones79/...).
[DATA_EXFILTRATION] (LOW): The skill transmits a hashed machine ID and a persistent API key to the youware.com backend.
Evidence: src/machine-id.ts generates a SHA256 hash of the device ID, and src/api.ts sends it to /device/register and /device/code. The API key is stored locally in ~/.youskill/config.json.
[PROMPT_INJECTION] (LOW): Indirect prompt injection surface via tool output poisoning.
Ingestion points: src/api.ts (JSON payload from https://labs.youware.com/youskill/api/v1/recommend).
Boundary markers: Absent. The skill output is formatted for direct consumption by an AI agent.
Capability inventory: The skill suggests shell commands and prompt templates for the agent to execute.
Sanitization: Absent. The trigger_prompt and description from the API are displayed directly to the agent without escaping or filtering.

youskill-finder