tesco-product-scraper

SUSPICIOUS: the skill’s stated purpose matches browser-based scraping, but it instructs the agent to automatically install a separate skill and external CLI, extending trust to dynamic third-party runtime components. The install path appears plausibly official rather than overtly malicious, so this is a medium supply-chain and transitive-trust risk, not confirmed malware.