skill-lookup

SUSPICIOUS: the stated purpose matches discovery/installation of skills, but the trust model is weak. Its main risk is transitive skill installation from a third-party marketplace (`prompts.chat`) into `.claude/skills/` with no described signature, checksum, or publisher verification, allowing unreviewed instructions/scripts to become trusted local skills.