Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-09
This is a documentation-only skill (no scripts or code) that tells the agent how to search for and install other agent skills using the third-party `npx skills` command-line tool from skills.sh. When a user asks "is there a skill for X", the agent is instructed to run `npx skills find <query>`, show the results, and optionally install a chosen skill. The main concern is Step 4, which instructs the agent to install skills globally with `-g -y`, where `-y` skips all confirmation prompts. That means arbitrary third-party code from GitHub repositories can be fetched and installed into the user's agent environment without an explicit prompt, and whatever that code does is outside this skill's control. Nothing in the package touches credentials, wallets, environment variables, or sends data anywhere; the package's own skill-card even discloses this install risk. It is not malicious, but it is a gateway for installing unvetted code, so a careful user should require explicit approval before any install.
| Declared purpose | Help users discover and install agent skills from the open skills ecosystem (skills.sh) when they ask how to do something or want to extend agent capabilities. |
| Observed behavior | Pure instructional Markdown. It directs the agent to invoke `npx skills find`, `npx skills add`, `npx skills init` and to present results and links to skills.sh. No scripts, no file writes, no environment variable access, no network calls of its own, no obfuscation, no persistence. The only behavior exceeding a pure search helper is the recommendation to install third-party packages globally with confirmation prompts suppressed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | SKILL.md lines 48-50 and 91-93 instruct running shell commands `npx skills find [query]` and `npx skills add <owner/repo@skill> -g -y`. Searching requires running the CLI; the unattended install form is broader than search. |
| install_packages | needed | The skill's stated purpose includes installing skills, but line 92 uses `-g -y` to install globally and skip confirmation, pulling third-party code from GitHub into the user's agent. |
| network | needed | Indirect: `npx` fetches the skills CLI and the CLI queries skills.sh (SKILL.md line 32) and GitHub. The skill itself contains no direct network code. |
| severity | finding |
|---|---|
| medium | Instructs global install of third-party code with confirmation prompts disabled The `-y` flag suppresses confirmation and `-g` installs at user level. If the agent follows this instruction, arbitrary skill packages from GitHub repositories can be added to the user's environment without an explicit approval step, and any behavior in those packages then runs with the agent's privileges. A careful user should require manual approval and drop `-y`. SKILL.md:92 npx skills add <owner/repo@skill> -g -y |
| low | Explicitly documents bypassing confirmation The skill is transparent that it is telling the agent to skip prompts, which confirms the behavior is intentional rather than accidental, but it still removes the human checkpoint before installing untrusted code. SKILL.md:95 The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. |
| low | Runs a remotely fetched CLI via npx `npx skills` downloads and executes the `skills` package from the npm registry at run time. The code executed is not part of this package and is not pinned to a version, so its contents can change between runs. SKILL.md:23 The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. |
| info | Steers installs toward named third-party GitHub repositories Named external sources are well-known public repositories, not attacker-controlled endpoints, but the agent is nudged to trust specific third parties by default. SKILL.md:115 Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills` |
| info | Publisher discloses the install risk The package documents the same concern identified in the audit and recommends avoiding silent -y installs, which supports a CAUTION rather than UNSAFE reading. skill-card.md:19 Risk: The skill can steer broad requests into globally installing third-party skills with confirmation disabled. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| skills.sh | not in the service index | SKILL.md:32 |
| Binaries invoked | bash, docker, git, npx |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 133 | 54b44dc9539df865… |
_meta.json | 6 | da25028a5f1c6dfb… |
skill-card.md | 38 | 50ad57f1efa564ed… |
For agents
JSON: https://agenteconomy.report/k/find-skill.audit.json · badge: https://agenteconomy.report/k/find-skill.audited.svg ·
skill rating: /k/find-skill · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).