Tool Finder

This skill appears to do what it claims (a search wrapper for ClawHub and Smithery) but exercise caution before deploying widely. Specific recommendations: - Review the full scripts (tool-finder.sh) yourself; verify there are no calls to unexpected endpoints beyond ClawHub/Smithery. The script shown uses npx and standard CLIs (npx clawhub, npx @smithery/cli, curl). - Prefer pinning package versions or vendoring the CLI tools instead of relying on npx@latest at runtime (dynamic downloads increase supply-chain risk). Replace npx calls with a locally installed, versioned binary if possible. - Do not blindly apply the AGENTS.md changes that make this skill the default for all 'find/install' requests. That gives the skill broad automatic invocation; review and limit triggers to appropriate contexts to avoid unwanted activations. - If you plan to install, run the script in a sandbox or non-production environment first and inspect network traffic (which hosts it contacts) and which files it writes. - If you need higher assurance, ask the maintainer for a published homepage/repo and signed releases or request that the skill vendor provide pinned dependency manifests and network endpoint documentation. These steps will reduce the main risks (runtime code fetched via npm and the operational push to make the skill the agent-wide default).