find-skills

• Analyzed: May 11, 2026, 5:47 AM
• Findings: 1
• Version: 1.0.0
• Hash: bd75bd35641dce57468b7a2b0f34142578b886fb2a8bb6945d4c562b99d14885
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides instructions for the agent to search for and install third-party packages using the 'npx skills' CLI. It is classified as suspicious due to a potential shell injection vulnerability in the 'npx skills find [query]' command and the instruction to use the '-y' flag in SKILL.md, which bypasses user confirmation during global software installation. While these behaviors are aligned with the skill's stated purpose as a package manager, they represent significant security risks if the agent processes unvalidated user input.