amazon-asin-detail-scraper

SUSPICIOUS but moderate-risk rather than malicious. The skill’s purpose aligns with live browser scraping, but it expands trust by auto-installing a transitive dependency without user confirmation. Because the dependency path appears same-org and officially documented through BrowserAct GitHub/PyPI, this is mainly a supply-chain and execution-trust concern, not evidence of credential theft or incompatible behavior.