find-skills

SUSPICIOUS: the skill’s stated purpose matches its behavior, but its core function is transitive installation of third-party skills from a broad ecosystem. The official CLI provenance lowers malware confidence, yet the trust expansion, global install pattern, and skipped confirmations make this a meaningful supply-chain and permission-escalation risk for an AI agent.