find-skills

SUSPICIOUS. The stated purpose mostly matches the behavior: repo inspection, local marketplace reads, and remote catalog fetches are coherent for recommending skills. The main concerns are transitive trust and remote-content handling: it encourages installing third-party skills from a personal marketplace and optionally discovers more via web search, while relying on unpinned raw GitHub catalogs. It remains read-only and does not itself install anything, so this is not malware, but it has medium security risk due to indirect prompt-injection surface and skill-installation supply-chain exposure.