find-skills

Warn

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the npx skills utility to search for, install, and update agent capabilities.- [REMOTE_CODE_EXECUTION]: The skill encourages the installation of packages from external GitHub repositories using the npx skills add command. This process downloads and executes third-party code on the user's system.- [COMMAND_EXECUTION]: The instructions specifically advise the agent to use the -y flag during installation (npx skills add <package> -g -y). This flag explicitly bypasses confirmation prompts, leading to the silent installation and execution of external code without user review or intervention.- [EXTERNAL_DOWNLOADS]: The skill references and encourages fetching resources from the skills.sh registry and various third-party repository owners on GitHub.- [PROMPT_INJECTION]: The skill processes potentially untrusted output from external search queries. Maliciously named or described packages in the ecosystem could attempt to influence the agent's behavior or trick users into installing harmful software.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 21, 2026, 05:12 AM