技能 find-skills
📦
find-skills
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取
尋找並安裝代理技能
使用者通常不知道哪個代理技能適合某項任務。此技能會搜尋技能生態系、比較選項，並引導做出更安全的安裝決策。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "find-skills" from https://skillstore.io/skills/vercel-labs-find-skills.md and its manifest at https://skillstore.io/api/skills/vercel-labs-find-skills/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「find-skills」。 Find a skill for pull request reviews.
預期結果:
回應會列出一個或多個聚焦於審查的技能，說明來源信任訊號，並在安裝任何項目前先詢問。
正在使用「find-skills」。 Can you help me make my Next.js app faster?
預期結果:
回應會搜尋效能相關技能，摘要可能相符的項目，並在可用時建議已驗證的選項。
正在使用「find-skills」。 No matching skill exists for my workflow.
預期結果:
回應會說明找不到合適的技能，提供直接協助，並建議為重複使用建立自訂技能。
安全審計
高風險v7 • 2026/7/7 開啟版本化報告
The skill primarily contains legitimate marketplace discovery guidance, and several static hits are Markdown false positives. Real risk remains because the skill instructs agents to run npx-based Skills CLI commands, install third-party skills, and use global installation with skipped confirmation prompts.
1
已掃描檔案
143
分析行數
14
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
Global Install Skips Confirmation
The skill tells the agent to offer installation with a global install command and says the confirmation flag skips prompts. This can reduce user review before third-party skill content is installed.
The installation section explicitly covers installing for the user and explains global install plus skipped confirmation. The risk is contextual because the static findings do not capture the consent and supply-chain implications.
能力複核項目 (14)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Ruby/shell backtick execution
```bash
The fenced command installs a skill globally and includes an option that skips confirmation prompts. That can bypass an important user safety checkpoint during third-party installation.
高
Ruby/shell backtick execution
```
This location is tied to the global install example and its skipped confirmation behavior. The surrounding guidance makes the external command materially riskier than a read-only search.
高
Ruby/shell backtick execution
The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts.
The line explicitly explains that one option installs globally and another skips confirmation prompts. Encouraging this combination increases supply-chain and consent-bypass risk.
中
Ruby/shell backtick execution
- `npx skills find [query] [--owner <owner>]` - Search for skills interactively or by keyword, optio
The skill documents an npx command that an agent may run to search skills. Running npx can execute package-manager code and perform network activity, so this is a real external command risk.
中
Ruby/shell backtick execution
- `npx skills add <package>` - Install a skill from GitHub or other sources
The line documents installing a skill from GitHub or other sources. That can add third-party content to the user environment, so it is a real supply-chain risk.
中
Ruby/shell backtick execution
- `npx skills check` - Check for skill updates
The check command invokes the external Skills CLI and may contact the package ecosystem. The command is legitimate, but it is still external command execution.
中
Ruby/shell backtick execution
- `npx skills update` - Update all installed skills
The update command can modify installed skills through the external Skills CLI. That creates a real risk if updates are pulled from compromised or unreviewed sources.
中
Ruby/shell backtick execution
```bash
The fenced block contains the npx skills find command and the prose tells the agent to run it. This is external command execution, even though it is part of the intended workflow.
中
Ruby/shell backtick execution
- User asks "how do I make my React app faster?" → `npx skills find react performance`
The line gives an npx skills find command as an example the agent can run for a user request. It is a legitimate use case but still executes an external package-manager CLI.
中
Ruby/shell backtick execution
- User asks "can you help me with PR reviews?" → `npx skills find pr review`
The line gives an npx skills find command as an example for pull request review requests. This is a real external command recommendation with network and package-manager risk.
中
Ruby/shell backtick execution
- User asks "I need to create a changelog" → `npx skills find changelog`
The line gives an npx skills find command for changelog searches. The command is benign in intent but still requires executing the external Skills CLI.
中
Ruby/shell backtick execution
```
The example response includes a Skills CLI install command. Installing a skill introduces third-party code or instructions into the user environment.
中
Ruby/shell backtick execution
3. Suggest the user could create their own skill with `npx skills init`
The line suggests an npx initialization command for creating a new skill. It may be appropriate, but it still runs the external Skills CLI and can write files.
中
Ruby/shell backtick execution
```
The example block includes an npx skills init command. This executes external tooling and can create local files, so it is not only Markdown formatting.
風險因素
⚙️ 外部命令 (21)
🌐 網路存取 (3)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/vercel-labs-find-skills/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/vercel-labs-find-skills?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/vercel-labs-find-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-find-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/vercel-labs-find-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
vercel-labs. (2026). find-skills security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-find-skills/audits/7BibTeX 引用
@techreport{vercel-labs-vercel-labs-find-skills-2026,
author = {vercel-labs},
title = {find-skills security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/vercel-labs-find-skills/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "find-skills security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "vercel-labs"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/vercel-labs-find-skills/audits/7"
identifiers:
- type: other
value: "skillstore:vercel-labs-find-skills:audit:7"
description: "Skillstore immutable audit report identifier"
比較變體
3 個可安裝變體每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。
為何此變體排名第一
Skillstore 評分最高
作者 / 來源 Skillstore 評分 證據置信度 Skillstore 使用量 已更新
agentspace-so-find-skills
Skillstore 評分 75
證據置信度 高
Skillstore 使用量 154
已更新
2026-10-22
Skillstore 評分
評分依據 證據置信度: 高 55
架構
85
可維護性
87
內容
79
社群
91
規範符合度
你可以打造什麼
探索工作流程技能
為重複性任務尋找技能，例如變更日誌、審查、測試或部署。
比較可信任的技能選項
在選擇技能前，檢視安裝次數、維護者和來源聲譽。
擴充代理設定
無需手動瀏覽儲存庫，即可為 Claude、Codex 或 Claude Code 新增相關能力。
試試這些提示
尋找基本技能
Find a skill that helps with writing changelogs. Show me the best option and why it fits.
比較選項
Search for skills for React performance work. Compare the top options by source reputation and install count.
檢查安裝風險
Find a skill for CI debugging, then assess whether I should install it based on maintainer trust and repository signals.
規劃技能推出
Find skills for documentation, pull request review, and testing. Recommend a safe installation order for a team environment.
最佳實務
- 在執行 CLI 命令前，確認使用者想要進行 marketplace 搜尋。
- 優先選擇來自具良好聲譽維護者、且有可見採用訊號的技能。
- 新增第三方技能前，先審查來源和安裝範圍。
避免
- 不要只因為技能出現在搜尋結果中就安裝它。
- 不要在修改環境前略過使用者同意。
- 不要在未說明信任風險的情況下推薦未知來源。
常見問題
這個技能做什麼？
它協助尋找符合使用者任務的代理技能，並說明如何評估它們。
它會自動安裝技能嗎？
它可以提供安裝指引，但安裝應只在使用者核准後進行。
哪些工具可以使用它？
報告列出對 Claude、Codex 和 Claude Code 的支援。
它如何選擇推薦項目？
它會考量任務契合度、安裝次數、維護者聲譽和儲存庫信任訊號。
它可以審查每個技能的安全性嗎？
不會。它提供選擇指引，但每個第三方技能在安裝前仍應審查。
找不到技能時會發生什麼事？
它會主動協助處理該任務，並可能建議建立新的自訂技能。
開發者詳細資訊
作者
vercel-labs授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
36e07d5e13068e5be64447e8f20b427cf2cbd21a
維護新鮮度
2026/7/18
使用量
412 次下載 · 400 次瀏覽
檔案結構
📄 SKILL.md