made-in-china-product-scraper

SUSPICIOUS: the stated scraping purpose is plausible, but the skill is not self-contained and directs the agent to auto-install and trust a separate BrowserAct skill and CLI without user confirmation. The dependency trail looks same-brand and partly verifiable rather than overtly malicious, so this is better classified as transitive-installation and supply-chain risk than confirmed malware.