find-skills

SUSPICIOUS. The skill’s behavior matches its stated purpose, but that purpose is inherently high-trust: it searches for and installs other skills, including potentially third-party remote content. The CLI appears official and same-org documented, so this is not confirmed malware, but the transitive skill-installation model and suggested global non-interactive install make it a meaningful supply-chain risk.