alibabacloud-find-skills

SUSPICIOUS. The core discovery behavior is coherent and uses official Alibaba Cloud endpoints without credential harvesting, but the skill's purpose includes installing other skills, which creates meaningful transitive-trust and supply-chain risk. The same-org Alibaba install path looks proportionate; the broader downstream-skill execution model and alternate `clawhub` installer keep overall risk above benign.