firefox-devtools-mcp-automation

SUSPICIOUS. The skill is broadly coherent with its stated Firefox automation purpose and uses an official-seeming npm/Mozilla supply chain, but it exposes high-impact browser/session access, optional arbitrary script execution, network capture, and a TLS-bypass option. The biggest trust issue is outdated install guidance pointing to a deprecated unscoped package rather than Mozilla's current scoped package; this is more supply-chain hygiene and scope-risk than confirmed malicious behavior.