find-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited find-skills (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill helps you discover and install skills from the open agent skills ecosystem.
Use this skill when the user:
The Skills CLI (npx skills) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
Key commands:
npx skills find [query] - Search for skills interactively or by keywordnpx skills add <package> - Install a skill from GitHub or other sourcesnpx skills check - Check for skill updatesnpx skills update - Update all installed skillsBrowse skills at: https://skills.sh/
Before running any npx skills command, check if npx is available:
which npxIf npx is not found, fall back to the bundled bun shipped with Cherry Studio. Cherry Studio sets the CHERRY_STUDIO_BUN_PATH environment variable pointing to its bundled bun binary. Use it as follows:
if [ -n "$CHERRY_STUDIO_BUN_PATH" ] && [ -x "$CHERRY_STUDIO_BUN_PATH" ]; then
"$CHERRY_STUDIO_BUN_PATH" x skills <subcommand> [args]
else
echo "Error: Neither npx nor bundled bun found. Install Node.js or run Cherry Studio's bun installer."
fiFor example, npx skills find react becomes "$CHERRY_STUDIO_BUN_PATH" x skills find react.
Always try npx first. Only use the bun fallback when npx is unavailable.
When a user asks for help with something, identify:
Run the find command with a relevant query:
npx skills find [query]For example:
npx skills find react performancenpx skills find pr reviewnpx skills find changelogThe command will return results like:
Install with npx skills add <owner/repo@skill>
vercel-labs/agent-skills@vercel-react-best-practices
└ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practicesWhen you find relevant skills, present them to the user with:
Example response:
I found a skill that might help! The "vercel-react-best-practices" skill provides
React and Next.js performance optimization guidelines from Vercel Engineering.
Source: https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices
To install it (after you've reviewed the source):
npx skills add vercel-labs/agent-skills@vercel-react-best-practices⚠️ Security: Skills are third-party code that runs with full agent permissions. A malicious skill could read, modify, or delete files in your project.
Before installing any skill you MUST:
code and will have access to their project files.
any scripts it contains.
npx skills adduntil the user says "yes" or equivalent. Never install silently.
Only after the user confirms, run:
npx skills add <owner/repo@skill> -yThe -y flag is required for non-interactive execution, but the user confirmation step above ensures the user has reviewed and approved the install.
Skills are installed to the current project's .claude/skills/ directory.
When searching, consider these common categories:
| Category | Example Queries |
|---|---|
| Web Development | react, nextjs, typescript, css, tailwind |
| Testing | testing, jest, playwright, e2e |
| DevOps | deploy, docker, kubernetes, ci-cd |
| Documentation | docs, readme, changelog, api-docs |
| Code Quality | review, lint, refactor, best-practices |
| Design | ui, ux, design-system, accessibility |
| Productivity | workflow, automation, git |
vercel-labs/agent-skills or ComposioHQ/awesome-claude-skillsIf no relevant skills exist:
npx skills initExample:
I searched for skills related to "xyz" but didn't find any matches.
I can still help you with this task directly! Would you like me to proceed?
If this is something you do often, you could create your own skill:
npx skills init my-xyz-skill~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.