find-skills

SUSPICIOUS: the skill’s stated purpose matches its capabilities, and the `npx skills` installer has same-org official provenance. However, its main job is transitive installation of untrusted third-party skills from a public registry, which creates a significant supply-chain and prompt-injection risk even with the documented confirmation and triage safeguards.