find-skills
Warn
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes system commands using the
npx skillsCLI to search for, add, and manage agent skills. - [EXTERNAL_DOWNLOADS]: Fetches and installs code packages from external repositories. While the skill highlights trusted sources such as Vercel Labs, it also allows installation from arbitrary GitHub repositories.
- [REMOTE_CODE_EXECUTION]: The
npx skills addcommand installs new functionality into the agent's environment, which involves downloading and executing code from remote sources. - [PROMPT_INJECTION]: The skill uses unvalidated user input to construct search queries for the
npx skills findcommand, creating an attack surface for indirect prompt injection via malicious search results or manipulated queries.
Audit Metadata