sephora-product-scraper

SUSPICIOUS: the stated scraping purpose matches the browser-automation capability, and the named dependency appears to be an official BrowserAct runtime. The main risk is proportionality and trust expansion: this skill is mostly a wrapper that can auto-install and invoke another Skill/CLI without separate approval, creating transitive supply-chain and autonomous-install risk rather than clear malicious behavior.