amazon-bestseller-ranking-scraper

SUSPICIOUS: the core scraping purpose is plausible, but the skill expands scope by auto-installing a separate BrowserAct skill/CLI and directing the agent to do so without extra user confirmation. The dependency appears same-brand and officially documented, so this is not clearly malicious, but the transitive trust chain, external runtime reliance, and limited CLI transparency make the security posture medium risk.