find-skills

SUSPICIOUS: the skill’s purpose and capabilities are aligned, and the CLI appears to be official to the same ecosystem, so this is not confirmed malware. However, the skill’s main job is transitive installation of remote third-party skills, including global non-interactive installs, with broad source support and weak version/integrity guarantees; that makes it a high trust-boundary expansion risk.