skill-finder

Suspicious. The skill is internally consistent and not overtly malicious, but its whole purpose is to discover and install third-party skills, creating a high transitive supply-chain risk. Official ecosystem evidence lowers malware concern, yet the ability to fetch mutable community skills from broad upstream sources makes the overall security risk high.