facebook-marketplace-seller-reference-scraper

SUSPICIOUS. The skill’s stated purpose broadly matches its scraping behavior, and the BrowserAct dependency chain appears same-org and officially documented. The main issues are transitive skill installation, automatic install without separate confirmation, and reliance on an external CLI with only partially verifiable provenance from the provided evidence. No clear credential harvesting or incompatible data exfiltration is shown.