product-research

SUSPICIOUS: the core behavior matches the stated product-research purpose, but the skill is over-permissioned and exposed to indirect prompt injection because it browses arbitrary web content while retaining Bash and file-write capability. No evidence of malware or deceptive credential theft is present, and no suspicious installer is specified, but the unnamed Google Sheets MCP integration and broad action surface make this a medium-risk skill rather than benign.