gumroad-product-scraper

SUSPICIOUS: the scraping purpose broadly matches the capability, but the skill is not self-contained and instructs automatic installation of a transitive BrowserAct skill/CLI without separate approval. The dependency appears same-brand and plausibly official rather than an obvious credential-harvesting proxy, so this is more a trust-expansion and autonomy risk than confirmed malware.