skill-find
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill queries and installs skills from the public SkillsMP marketplace (skillsmp.com), which hosts user-submitted/third-party skill pages that the agent will fetch and read/interpret, exposing it to untrusted external content.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill provides a runtime "install" command that fetches and installs skill code from https://skillsmp.com/skills/author-repo-skill-name, which would pull remote code/content at runtime that can be executed or used to control agent prompts.
Audit Metadata