jev-browser-choice

SUSPICIOUS. The core capability fits the stated purpose, and direct TypeSafe API usage would be proportionate, but the skill reads a local API key file and can route both page data and credentials through an unverifiable local router path. No confirmed malware or overt exfiltration beyond the declared API call, yet the undocumented intermediary and raw credential handling make the trust model weaker than a benign vendor-direct integration.