mercari-marketplace-scraper

SUSPICIOUS: the Mercari scraping purpose is coherent, but the skill expands scope by auto-installing a separate BrowserAct skill/CLI without user confirmation. Data flow is broadly consistent with scraping, and the dependency appears same-org and officially documented, so this is not strong evidence of malicious intent; the main issue is moderate supply-chain and transitive-trust risk.