amazon-review-scraper

SUSPICIOUS: The stated purpose matches review scraping, and the BrowserAct dependency appears to come from the publisher’s official domain/GitHub/PyPI path rather than an obvious attacker source. But the skill expands trust by auto-installing another skill and external CLI without user confirmation, using an unpinned runtime dependency. This is a coherent but medium-risk transitive supply-chain pattern, not confirmed malware.