tiktok-shop-review-scraper

SUSPICIOUS. The stated purpose matches review scraping, and the BrowserAct dependency appears to be an official same-org tool rather than an obvious credential-harvesting lure. Risk comes from automatic installation without separate confirmation and the transitive trust chain into another skill plus CLI-served runtime behavior, not from clear malicious or disproportionate data exfiltration in this skill itself.