volcengine-find-skills

SUSPICIOUS: the skill is purpose-aligned as a skill finder/installer, but its main function is transitive installation of other skills through an external CLI. Default data flow is coherent and same-org, so this is not malicious, yet the ability to add arbitrary skills and override source creates meaningful supply-chain and trust-chain risk.