platform-capability-search

SUSPICIOUS: the main behavior is coherent with a Salesforce capability-discovery skill, and most execution paths are tightly constrained. The primary concern is the guarded add flow, which performs transitive skill installation via a third-party npm CLI; that is proportionate to the purpose but still a meaningful supply-chain and trust-extension risk.