alibaba-supplier-lead-research

SUSPICIOUS. The stated purpose is coherent, but the skill is not self-contained: it auto-installs and delegates to an external skill and CLI, and it instructs the agent to do so without user confirmation. Evidence suggests BrowserAct is a legitimate same-org dependency, so this is not confirmed malware, but the transitive install chain and autonomous dependency installation make it medium-to-high risk.