The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes system-level commands using npx in PowerShell and CMD to manage external packages.
[COMMAND_EXECUTION]: The troubleshooting section explicitly instructs users to "Try running in PowerShell as Administrator," which facilitates unnecessary privilege escalation for standard package management tasks.
[REMOTE_CODE_EXECUTION]: The skill performs global installation of arbitrary code from an open ecosystem using npx skills add <owner/repo@skill> -g -y. The use of the -y flag suppresses security prompts and user confirmation during installation, while the -g flag installs code globally on the host system.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes packages from the npm registry and references https://skills.sh/, an external and unverified repository for third-party scripts.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through search results. * Ingestion points: Search results returned by npx skills find from the https://skills.sh/ registry. * Boundary markers: Absent; third-party skill descriptions are presented directly to the agent without delimiters. * Capability inventory: System command execution (npx), global package installation (-g), and network access via CLI. * Sanitization: No sanitization or validation of skill metadata from the external registry is implemented before presentation.

find-skills