find-skills

SUSPICIOUS: The skill’s purpose and capabilities are internally consistent, and it relies on an official same-org CLI distributed via npm. The main risk is proportional but notable: its primary function is to discover and install other skills, introducing transitive trust in third-party skill content and broad downstream permissions. Not malicious on its face, but medium risk due to skill-to-skill installation and reduced-prompt install flow.