find-skills
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
npx skillscommand-line interface to perform search, installation, and update operations. - Evidence:
npx skills find [query],npx skills add <package>,npx skills check, andnpx skills updatecommands are documented in SKILL.md. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of capabilities from external sources, specifically GitHub repositories.
- Evidence: SKILL.md describes the use of
npx skills add <owner/repo@skill>to fetch and install packages. It specifically references repositories from Vercel Labs. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes and presents data from an external registry to the user.
- Ingestion points: Search results from the
npx skills findcommand are ingested into the agent's context (SKILL.md). - Boundary markers: No specific delimiters or boundary markers are defined for the search result output.
- Capability inventory: The skill has the capability to execute commands like
npx skills addto modify the agent's environment (SKILL.md). - Sanitization: No sanitization or validation of external package descriptions is mentioned.
Audit Metadata