find-skill

SUSPICIOUS: the skill’s purpose and commands are internally consistent and use an official CLI from the same ecosystem, so this is not malware. However, its whole function is to discover and install other skills, and the official CLI supports broad third-party source types, creating meaningful transitive supply-chain risk even with the skill’s explicit approval safeguards.