find-skills

SUSPICIOUS: the skill's stated purpose matches discovering/installing skills, and the `npx skills` CLI appears official. However, it is a transitive installer by design and uses an outdated/opaque `install-skill.sh` flow rather than the documented official install command, so it meaningfully expands trust to third-party skills and should be treated as high-risk workflow tooling rather than a benign reference skill.