70High
The skill insecurely executes unpinned npx packages and forces automatic installations via the -y flag, creating significant risks of supply chain attacks and unauthorized package deployment.
Skill Info
Namevercel-labs/skills/find-skills
Registrygithub
Version2adcfe5a4cce
PURLpkg:github/vercel-labs/skills@2adcfe5a4cce?skill=find-skills
Stars24,466
Installs2,300,000
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
2,300,000 installs
Skills.shDocs
npx skills add https://github.com/vercel-labs/skillsAssessments (3)
AI Agent Traps ↗Forced non-interactive installationhighsocial engineeringAML.T0052.000LLM09:2025
The instructions explicitly direct the agent to use the '-y' flag during installation, which bypasses user confirmation prompts and increases the risk of installing malicious or unintended packages. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
90% confidenceline 101
npx skills add <owner/repo@skill> -g -y
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime — 12 occurrences in this skill; showing the first 10 (aggregate, 2 suppressed to bound noise)
95% confidence
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 10 times in this file at lines 27, 28, 29, 30, 57, 62, 63, 64, 91, 101)
95% confidenceline 27
npx skills
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/vercel-labs/skills/find-skills)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/vercel-labs/skills/find-skills"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/skills/find-skills.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/skills/find-skills.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow