skill-finder

SUSPICIOUS: the skill’s purpose is coherent, but it deliberately expands trust to external registries, third-party npm tooling, and transitive skill installation. The safeguards (catalog pre-check, top-down trust tiers, mandatory eval, exact pinning) make it more controlled than malicious, yet adoption of outside skills remains a medium supply-chain risk.