tesco-product-scraper

The skill's scraping purpose broadly matches its stated capabilities, and the BrowserAct dependency appears to come from a consistent same-org distribution path. The main risk is not overt malware but delegated trust: it auto-installs and relies on another skill and CLI, and instructs the agent to do so without separate approval. Overall this is a medium-risk, suspicious-by-design dependency wrapper rather than a clearly malicious skill.