find-skills

SUSPICIOUS: the skill is coherent with its purpose, and the CLI/install path appears officially documented by the same ecosystem, so this is not confirmed malware. However, its core function is to discover and install other skills from third-party sources, creating transitive trust and downstream permission inheritance; that makes it a meaningful security risk even without direct credential theft or hidden exfiltration.