automation-browser

SUSPICIOUS. The skill is internally coherent for browser-driven security testing, and its primary installs are from verifiable official sources, so this is not confirmed malware. However, it is a high-risk offensive security skill for AI agents: it automates interaction with live targets, supports XSS/client-side auth testing, intercepts and modifies traffic, and extends into desktop GUI/network capture via OpenReverse. The biggest concern is capability scope and real-world impact, not deceptive data exfiltration or hidden credential theft.