find-skills
Warn
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
npx skillsCLI tool to execute various system commands, including searching (find), installing (add), and updating software on the host system. - [EXTERNAL_DOWNLOADS]: The skill retrieves information from the external registry
https://skills.sh/and facilitates the downloading of software directly from GitHub repositories. - [REMOTE_CODE_EXECUTION]: The skill enables the automated installation and execution of remote code through the
npx skills add <package> -ycommand. The inclusion of the-yflag is a concern as it instructs the agent to skip confirmation prompts, which could lead to the installation of malicious packages if the search results are manipulated or if the user is misled into installing an untrusted repository.
Audit Metadata