find-skills

SUSPICIOUS: the skill's stated purpose matches its behavior, and the CLI/source relationship appears legitimate, but it is inherently higher risk because it installs other skills from a broad ecosystem and can do so globally with confirmation disabled. Main concern is transitive trust and supply-chain exposure, not confirmed malware or credential theft in this skill itself.