rental-assistant

SUSPICIOUS. The skill’s purpose and capabilities are largely coherent and it does not request explicit credentials, but it relies on opaque local CLI wrappers, a browser-automation WebBridge dependency, and a transitive skill dependency. The only explicit install step is an auxiliary Homebrew tap, which raises moderate supply-chain concern rather than confirming malware. Overall this looks like a plausible rental-search skill with medium trust and supply-chain risk, not confirmed malicious behavior.