find-skills

SUSPICIOUS: the skill’s stated purpose matches its behavior, but that behavior is inherently high-risk because it installs additional skills from an open ecosystem and extends trust to unreviewed third-party content. The npm package provenance is reasonably legitimate, so this is not confirmed malware, but the transitive-install model, broad allowed source types, and alternate registry domain make it a high security-risk skill.

No clear malicious behavior is present in the script itself. The principal risks are runtime execution of an unpinned npm package via `npx -y`, global non-interactive installation of externally sourced skills, and transmission/exposure of authentication credentials through configurable endpoints and process arguments. These are significant supply-chain and credential-handling concerns, but they are consistent with the stated registry-wrapper purpose.