find-skills

SUSPICIOUS. The skill is coherent with its purpose, and the `skills` CLI appears to be an official Vercel-published tool. However, the purpose itself is high-risk: it instructs the agent to install third-party skills from arbitrary repositories and mutable sources, creating a transitive trust chain and local filesystem changes. This is not confirmed malware, but it is a materially risky capability for an agent skill.