SaaS Metrics
Gemini Executive Synthesis
The `npx skills add` command for installing agent skills, specifically its telemetry functionality.
Technical Positioning
User consent and data privacy in developer tooling. The issue implies a breach of trust regarding 'unauthorized connection' and 'exfiltrated private data'.
SaaS Insight & Market Implications
This issue exposes a severe trust and privacy breach within the `npx skills add` installation process. The command initiates telemetry data exfiltration to a third party (`skills.sh`) without explicit user consent, a practice the user labels as 'malware'. While a CLI flag exists to disable telemetry, its non-obvious nature and default-on behavior constitute a critical failure in user transparency and data governance. For B2B SaaS, particularly developer tools, such practices are unacceptable. They erode developer trust, invite security scrutiny, and can lead to compliance violations. The market demands explicit opt-in for data collection, especially when private usage information is involved. This incident highlights the reputational and adoption risks associated with opaque telemetry practices, directly impacting the perceived integrity of the entire `skills` platform.
Proprietary Technical Taxonomy
Raw Developer Origin & Technical Request
GitHub Issue
Jul 31, 2026
Repo: AminBlg/SimpleEnglish
README command invokes malware
See also: github.com/vercel-labs/skill...
I ran the command `npx skills add AminBlg/SimpleEnglish` from the readme, and without my consent, an unauthorized connection was made from my computer to a remote host, surreptitiously uploading private usage information to a third party. Please remove references to this malware.
Developer Debate & Comments
https://github.com/vercel-labs/skills/blob/7cb7db64dc1201052dea305e508a2fc490f7e5e2/src/telemetry.ts#L1
If you install skills using "npx skills", it sends telemetry events to skills.sh for ranking skills. See https://www.skills.sh/docs . You can turn it off using a cli flag
Yes, I am aware of this - now - only after it has exfiltrated private data from my machine without consent.
Adjacent Repository Pain Points
Other highly discussed features and pain points extracted from AminBlg/SimpleEnglish.
Extracted Positioning
LLM-driven documentation generation in Simplified Technical English (STE), specifically the 'check mode' functionality for reporting rule violations.
Accurate and verifiable citation of STE rule numbers, preventing LLM hallucination and ensuring auditability of compliance reports.
Extracted Positioning
LLM-driven documentation generation in Simplified Technical English (STE), specifically the 'vocabulary discipline table' for part-of-speech rulings.
Accurate adherence to ASD-STE100 Issue 9 dictionary, ensuring precise linguistic control for technical documentation and factual correctness.
Extracted Positioning
LLM-driven documentation generation in Simplified Technical English (STE), specifically the 'consistency pass' for vocabulary discipline.
Strict adherence to ASD-STE100 Issue 9 dictionary for technical English compliance, aiming for 'no AI slop' and high-quality, rule-based output.
Frequently Asked Questions
Market intelligence mapped to The `npx skills add` command for installing agent skills, specifically its telemetry functionality..
How is The `npx skills add` command for installing agent skills, specifically its telemetry functionality. positioned in the market?
Based on our AI analysis of the original developer request, its primary technical positioning is: User consent and data privacy in developer tooling. The issue implies a breach of trust regarding 'unauthorized connection' and 'exfiltrated private data'.
How is the developer community reacting to The `npx skills add` command for installing agent skills, specifically its telemetry functionality.?
Yes, we have tracked 3 direct responses and active debates regarding this specific topic originating from GitHub Issue.
What are the foundational technologies related to The `npx skills add` command for installing agent skills, specifically its telemetry functionality.?
Our proprietary extraction maps The `npx skills add` command for installing agent skills, specifically its telemetry functionality. to adjacent architectural concepts including npx skills add, telemetry events, remote host, private usage information.
Are there startups building around The `npx skills add` command for installing agent skills, specifically its telemetry functionality.?
Yes, market intelligence reveals commercial overlap. A product named 'Calling Skills for AI Agents' focuses directly on this: Add voice and video calling via your coding agent
Engagement Signals
Cross-Market Term Frequency
Quantifies the cross-market adoption of foundational terms like npx skills add and third party by tracking occurrence frequency across active SaaS architectures and enterprise developer debates.