made-in-china-supplier-scraper

SUSPICIOUS: The stated purpose matches supplier scraping, but the skill requires automatic installation of a separate BrowserAct skill and CLI without separate confirmation, creating a transitive trust and supply-chain risk. The install path appears same-org and plausibly official rather than overtly malicious, so this is not confirmed malware; the main issue is expanded execution trust beyond the declared scraper wrapper.