tiktok-shop-live-product-reference-scraper

SUSPICIOUS. The scraping purpose is aligned with the stated capability, but the skill’s real footprint depends on automatically installing and trusting the external BrowserAct skill/CLI and its remote runtime content. Because the dependency appears to be same-org and officially documented, this is not strong evidence of malware, but it is a meaningful medium supply-chain and transitive-trust risk.