find-skills

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the npx skills command-line utility to perform searches, updates, and installations of external functionality.- [EXTERNAL_DOWNLOADS]: Utilizes npx skills add to fetch and install skills from remote repositories, including GitHub. It identifies trusted sources such as the vercel-labs organization for these downloads.- [REMOTE_CODE_EXECUTION]: Uses the npx package runner to execute the skills management tool, which involves downloading and running code from the npm registry at runtime.- [PROMPT_INJECTION]: Ingests search results from the npx skills find command which creates an indirect prompt injection surface where malicious package metadata could influence the agent; however, the skill provides instructions for identifying reputable sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 11:41 PM