ai-web-scraping-scrapegraph

SUSPICIOUS: The skill’s scraping capabilities broadly match its purpose, but its trust boundary is wider than advertised. It reads a local credential file and sends both the token and user-provided scrape data through GooseWorks proxy endpoints instead of directly to ScrapeGraph, and package/repo provenance is somewhat unclear. This looks more like a managed integration with notable credential and data-flow risk than outright malware.