lightpanda

SUSPICIOUS: the skill's core browser and automation capabilities fit its stated purpose, but the trust model is broad. Main concerns are the bundled nightly installer, wildcard execution permission, transitive installation guidance, and high exposure to prompt injection from untrusted web content combined with action-taking browser tools. No clear evidence of credential harvesting or overtly malicious data routing is present in the provided skill text.