The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the npx skills CLI to fetch and install packages from the skills.sh registry and arbitrary GitHub repositories. These external sources are not part of the established trusted vendor or well-known service lists.
[REMOTE_CODE_EXECUTION]: The core functionality of the skill involves downloading and executing remote code via npx skills add and npx skills update. This allows third-party logic to be integrated into the agent's environment at runtime.
[COMMAND_EXECUTION]: The skill documentation explicitly suggests the use of the -y (yes/assume-yes) and -g (global) flags. The -y flag is a security concern as it bypasses interactive confirmation prompts, enabling the automated installation of potentially unvetted software.
[PROMPT_INJECTION]: The skill's workflow depends on user-provided queries being passed to the npx skills find command. This creates an attack surface for indirect prompt injection where a user could manipulate the search results or trick the agent into installing malicious packages.

find-skills