skill-finder

SUSPICIOUS: the stated purpose is skill discovery, but its actual footprint is to autonomously extend the agent by installing unreviewed third-party skills from a community registry and unofficial CLI path. The main risk is transitive trust and automatic capability expansion, not confirmed malware.