search-cold-skills

SUSPICIOUS: the stated purpose is coherent, but the skill's main function is to locate and manually load other skills, creating a transitive trust chain. The npm/CLI reference appears same-org and official, which lowers supply-chain concern, but executing local helper scripts and following arbitrary cold SKILL.md content makes this a medium-risk skill rather than benign.