finding-resources

SUSPICIOUS. The core purpose is benign and the web-search behavior is proportionate, but the skill instructs the agent/user to install additional MCP search tools via unpinned npx commands, creating transitive trust and supply-chain risk. Several recommended package names do not match current official install paths, which is an internal consistency issue. No confirmed malware, credential theft, stealth, or malicious exfiltration is present.