find-skills

After evaluating all 220 static findings, the vast majority are false positives. The CRITICAL 'dangerous combination' heuristic fires because the script has external_commands, network, and env_access patterns — but the env_access hits are grep PATTERNS inside the built-in security scanner (line 164 checks if OTHER skills reference ~/.ssh, ~/.aws, .env, or private keys), not actual credential reads. All network calls are read-only GETs to public registries (skills.sh, clawhub.ai, raw.githubusercontent.com). The 'weak crypto' hits are false positives from keywords like 'hash' and 'key' in scanner regexes. This is a well-designed, defensive discovery tool with no malicious intent.