viral-product-evaluator

SUSPICIOUS: the core behavior mostly matches the stated purpose, but the mandatory dependency path installs another AI skill from GitHub through asm, creating a transitive trust chain broader than a simple evaluator needs. No clear credential theft, stealth, or malicious exfiltration is present in the visible skill, so this is not malware; the main risk is supply-chain and delegated browser-skill trust.