gmaps

SUSPICIOUS: the runtime behavior is broadly consistent with a Google Maps scraping skill, and data flows mostly stay between the local browser and google.com/maps. The main concerns are install/execution trust: an unseen setup script, a transitive dependency on browser-harness-js, and possible automatic Bun installation. This looks more like a high-friction browser automation skill with medium supply-chain risk than confirmed malware.