spider

SUSPICIOUS. The core crawling/scraping behavior matches the stated purpose, and installs are from standard registries. But the skill mixes scraping, security scanning, and AI analysis, and its Gemini setup is internally inconsistent: it asks for a Google API key and installs a legacy Python package while invoking a separate CLI. Main risk is medium supply-chain/trust confusion plus indirect prompt-injection from sending arbitrary web content to an LLM, not confirmed malware.