find-skills

SUSPICIOUS. The skill is largely coherent with its stated purpose and uses mostly official public endpoints, but its core function is transitive trust: it searches untrusted registries, reads external SKILL.md content, and steers the user toward installing third-party skills. The biggest risks are prompt-injection from fetched skill content and unpinned npm-based installation of additional skills, not direct credential theft or confirmed malware.