find-skills

SUSPICIOUS. The skill’s stated purpose matches its behavior, and the CLI provenance is consistent with the publisher, so this is not outright malicious. However, it directly enables transitive installation of third-party skills from GitHub/other sources, which expands the agent’s trust boundary and creates meaningful supply-chain risk even with the documented approval guardrails.