find-skills
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the
npx skillsutility to search for, install, and update agent capabilities.- [REMOTE_CODE_EXECUTION]: The skill encourages the installation of packages from external GitHub repositories using thenpx skills addcommand. This process downloads and executes third-party code on the user's system.- [COMMAND_EXECUTION]: The instructions specifically advise the agent to use the-yflag during installation (npx skills add <package> -g -y). This flag explicitly bypasses confirmation prompts, leading to the silent installation and execution of external code without user review or intervention.- [EXTERNAL_DOWNLOADS]: The skill references and encourages fetching resources from theskills.shregistry and various third-party repository owners on GitHub.- [PROMPT_INJECTION]: The skill processes potentially untrusted output from external search queries. Maliciously named or described packages in the ecosystem could attempt to influence the agent's behavior or trick users into installing harmful software.
Audit Metadata