shopify-store-lead-builder

SUSPICIOUS: the stated purpose matches Shopify lead research, but the skill expands trust by auto-installing and invoking the separate BrowserAct skill/CLI without user confirmation. The dependency source looks same-org and official rather than overtly malicious, so this is not confirmed malware; the main issue is transitive install/runtime trust and credential-capable external tooling being introduced for a scraping workflow.