bright-data-mcp

SUSPICIOUS. The skill’s core purpose matches its Bright Data web-scraping capabilities and its install sources appear official and same-org, so this is not confirmed malware. However, it is unusually forceful in replacing all native web tools, instructs the agent to read and modify local MCP config containing tokens, expands its own permissions/tool surface automatically, and processes large amounts of untrusted web content while retaining write capabilities. Those combined behaviors make it a medium-risk skill with notable autonomy and prompt-injection exposure.