mercari-marketplace-scraper

SUSPICIOUS: the core scraping purpose is coherent, but the skill expands trust by auto-installing and invoking a separate BrowserAct skill and CLI without separate confirmation. Data flow appears aligned with scraping and no clear exfiltration endpoint is shown, so this looks more like elevated supply-chain and transitive-install risk than confirmed malicious behavior.