agent-search

List all agents

Security Scan

The skill is an instruction-only helper that claims to list agents and requests no secrets or installs; it's mostly coherent, but there is limited context about the allowed Bash tool and the declared node/npm requirement which should be checked before trusting it.

Purpose & Capability

Name/description ('List all agents') matches the minimal instructions in SKILL.md. However, the SKILL.md declares required binaries node and npm even though there is no code or install spec in the package; this may be harmless (the external 'agent-browser' Bash tool might need node/npm), but the requirement is unexplained.

Instruction Scope

SKILL.md contains only metadata and an allowed-tools directive (Bash(agent-browser:*)). The instructions do not ask the agent to read files, environment variables, or external endpoints beyond invoking the allowed Bash tool, so there is no obvious scope creep in the provided text.

Install Mechanism

No install spec and no code files — the skill is instruction-only, which is the lowest-risk install profile.

Credentials

No environment variables, credentials, or config paths are requested. The skill does not ask for secrets or unrelated credentials.

Persistence & Privilege

Defaults are used (not always:true). The skill does not request persistent or elevated privileges in the metadata provided.

Assessment

This skill is instruction-only and asks for no secrets, so its on-disk footprint is minimal. Before installing, confirm what the allowed tool 'Bash(agent-browser:*)' actually does in your agent environment — in particular, verify whether that tool will only enumerate agent metadata and does not execute arbitrary shell commands or transmit agent data externally. Also check why node and npm are listed as required (the tool it calls may depend on them); if you don't have or allow node/npm, the skill likely won't function but is otherwise low-risk.

Loading…