find-skill

SUSPICIOUS: the stated purpose matches discovery/installation, but the skill mixes Orthogonal operations with Gooseworks credential files and explicitly installs additional skills, creating a high transitive-trust risk. The install source for @orth/cli appears legitimate, so this is not confirmed malware, but the credential mismatch and role as a skill loader make the overall footprint risky.