Find Skills.Local.Backup

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...

Security Scan

The skill's purpose (finding and installing other skills) is coherent, but there are provenance inconsistencies in the bundled metadata and the runtime instructions encourage running npx to fetch and globally install third-party packages (with -y) — which can execute arbitrary code — so you should be cautious.

Purpose & Capability

The SKILL.md clearly describes a 'find-and-install skills' helper and all runtime actions (using the Skills CLI via npx to search and add skills) match that purpose. However, the included _meta.json file and the registry metadata differ (ownerId, slug, and version/name variations), which is a provenance inconsistency and could indicate a copy/paste or packaging mismatch that deserves review.

Instruction Scope

Instructions explicitly tell the agent to run `npx skills find` and `npx skills add <...>` and to offer to install skills for the user (including recommending `-g -y` to install globally and skip prompts). Executing npx can run arbitrary remote code/packages; recommending global installs and skipping confirmations increases the chance of unintended persistent changes or installing unreviewed code. The guidance to proceed with installations is within the skill's stated purpose but grants broad discretion that can be risky if not confirmed by the user.

Install Mechanism

There is no install specification (instruction-only), which minimizes built-in footprint. However, the runtime approach relies on npx to fetch packages from npm/GitHub at execution time. That is a higher-risk action than pure local computation because it downloads and executes third-party code on demand.

Credentials

The skill declares no required environment variables, no credentials, and no special config paths. It does not request unrelated secrets or system-level credentials.

Persistence & Privilege

The skill does not set always:true and doesn't request to modify other skills' configurations. However, its recommended workflow (using `npx skills add -g`) installs packages globally on the host, which creates persistent, system-level changes. That persistence is consistent with installing skills but increases the impact of any malicious or buggy package pulled by npx.

What to consider before installing

This skill is coherent with its stated job (finding/installing skills) but contains two things to check before you let it act: (1) provenance mismatch — the bundled _meta.json values (owner/slug/version/name) don't match the registry metadata presented; ask the publisher to explain and verify the source repository before installing anything. (2) runtime risk — the skill's recommended workflow uses `npx` to fetch and run third‑party code and suggests `-g -y` (global install and skip confirmations). That can execute arbitrary remote code and make persistent system changes. If you want to proceed: ask the agent to only show candidate skills and links (do not install automatically), inspect the repository and README on skills.sh or GitHub yourself, avoid global installs and skipping prompts, and run install commands manually from a shell you control after reviewing the package source. If you need higher assurance, ask the publisher for a signed release or prefer skills from known/trusted owners.

Find Skills

This skill helps you discover and install skills from the open agent skills ecosystem.

When to Use This Skill

Use this skill when the user:

• Asks "how do I do X" where X might be a common task with an existing skill
• Says "find a skill for X" or "is there a skill for X"
• Asks "can you do X" where X is a specialized capability
• Expresses interest in extending agent capabilities
• Wants to search for tools, templates, or workflows
• Mentions they wish they had help with a specific domain (design, testing, deployment, etc.)

What is the Skills CLI?

The Skills CLI (npx skills) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.

Key commands:

• npx skills find [query] - Search for skills interactively or by keyword
• npx skills add <package> - Install a skill from GitHub or other sources
• npx skills check - Check for skill updates
• npx skills update - Update all installed skills

Browse skills at: https://skills.sh/

How to Help Users Find Skills

Step 1: Understand What They Need

When a user asks for help with something, identify:

1. The domain (e.g., React, testing, design, deployment)
2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
3. Whether this is a common enough task that a skill likely exists

Step 2: Search for Skills

Run the find command with a relevant query:

npx skills find [query]

For example:

• User asks "how do I make my React app faster?" → npx skills find react performance
• User asks "can you help me with PR reviews?" → npx skills find pr review
• User asks "I need to create a changelog" → npx skills find changelog

The command will return results like:

Install with npx skills add <owner/repo@skill>

vercel-labs/agent-skills@vercel-react-best-practices
└ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices

Step 3: Present Options to the User

When you find relevant skills, present them to the user with:

1. The skill name and what it does
2. The install command they can run
3. A link to learn more at skills.sh

Example response:

I found a skill that might help! The "vercel-react-best-practices" skill provides
React and Next.js performance optimization guidelines from Vercel Engineering.

To install it:
npx skills add vercel-labs/agent-skills@vercel-react-best-practices

Learn more: https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices

Step 4: Offer to Install

If the user wants to proceed, you can install the skill for them:

npx skills add <owner/repo@skill> -g -y

The -g flag installs globally (user-level) and -y skips confirmation prompts.

Common Skill Categories

When searching, consider these common categories:

Category	Example Queries
Web Development	react, nextjs, typescript, css, tailwind
Testing	testing, jest, playwright, e2e
DevOps	deploy, docker, kubernetes, ci-cd
Documentation	docs, readme, changelog, api-docs
Code Quality	review, lint, refactor, best-practices
Design	ui, ux, design-system, accessibility
Productivity	workflow, automation, git

Tips for Effective Searches

1. Use specific keywords: "react testing" is better than just "testing"
2. Try alternative terms: If "deploy" doesn't work, try "deployment" or "ci-cd"
3. Check popular sources: Many skills come from vercel-labs/agent-skills or ComposioHQ/awesome-claude-skills

When No Skills Are Found

If no relevant skills exist:

1. Acknowledge that no existing skill was found
2. Offer to help with the task directly using your general capabilities
3. Suggest the user could create their own skill with npx skills init

Example:

I searched for skills related to "xyz" but didn't find any matches.
I can still help you with this task directly! Would you like me to proceed?

If this is something you do often, you could create your own skill:
npx skills init my-xyz-skill