find-skills
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Facilitates access to the external skills.sh registry and references official repositories from well-known technology organizations like Vercel Labs.\n- [REMOTE_CODE_EXECUTION]: Provides instructions for installing external code using the
npx skills addcommand. The skill instructions include mitigations such as mandatory verification of publisher reputation, install counts, and repository maintenance signals.\n- [COMMAND_EXECUTION]: Utilizes the npx runner to execute discovery and installation tasks. The instructions include platform-specific advice for Windows environments, such as the use of the --copy flag to ensure predictable file system behavior during installation.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its dependency on external data from skill registry searches. \n - Ingestion points: Output data from the
npx skills findsearch command. \n - Boundary markers: Instructions explicitly maintain a boundary between NextClaw-native and external ecosystems. \n
- Capability inventory: The skill can execute shell commands and trigger package installations via the Skills CLI. \n
- Sanitization: The instructions require the agent to manually evaluate source quality and reputation before proceeding.
Audit Metadata