find-skills

SUSPICIOUS: The skill is purpose-consistent as a skill discovery/install helper, but its core behavior is transitive trust expansion. Using an official npm CLI lowers direct malware concern, yet installing third-party skills from broad remote sources gives those skills the agent's trust and permissions, which is disproportionate enough to warrant a suspicious classification.