best-practices-cots

SUSPICIOUS: The skill’s browser automation and visual analysis broadly match its stated compliance-audit purpose, but it has moderate risk because it can perform real UI actions, evaluate arbitrary JS from manifests, and may send sensitive screenshots/content through an opaque /scillm wrapper to an external VLM. Main concern is data-flow opacity and broad automation scope, not confirmed malware.