skills-finderlisted

# Skills Finder Discover skills on [skills.sh](https://skills.sh) and **gate every candidate through a security audit before adopting it**. The user's rule is firm: only adopt skills with no security problems. Never install a skill that has not cleared the audit. ## Workflow ``` 1. DISCOVER npx skills find "<query>" → candidate list 2. GATE scripts/audit.py <candidate>... → ADOPT / REVIEW / REJECT 3. DECIDE adopt only ADOPT (or REVIEW after explicit user OK) 4. INSTALL npx skills add <owner/repo@skill> → only for approved skills ``` ## Step 1 — Discover (no token needed) Use the `skills` CLI; it handles auth internally, so no Vercel token is required: ```bash npx -y skills@latest find "<query>" # e.g. "pdf", "postgres backup" npx -y skills@latest find "<query>" --owner <github-owner> # scope to an owner ``` Output lines look like `owner/repo@skill <N> installs` plus a `https://skills.sh/owner/repo/skill` URL. Higher installs ≠ safer — still gate. Other CLI verbs: `npx skills list` (installed), `npx skills add <owner/repo@skill>` (install), `npx skills use <owner/repo@skill>` (one-off prompt, no install). ## Step 2 — Security gate (MANDATORY, no token needed) Run every candidate through the audit script. The audit endpoint is public, so this always works: ```bash python3 scripts/audit.py <candidate> [<candidate> ...] # human-readable python3 scripts/audit.py <candidate> --json # machine-readable ``` A `<ca