qa

SUSPICIOUS. The skill's capabilities mostly match its QA purpose, and the Browser Use dependency appears same-org and officially documented. The main concerns are transitive plugin/CLI installation, external cloud-browser execution, API-key forwarding, and tunneling localhost apps to a third-party service. No strong signs of malware or deceptive exfiltration, but the external service footprint is broader than a purely local QA skill.