tiktok-shop-search-results-scraper

SUSPICIOUS: the stated purpose matches web scraping, but the skill expands trust by auto-installing and invoking the BrowserAct skill/CLI without separate approval. Publisher linkage appears legitimate and there is no clear credential-harvesting or exfiltration path in this skill itself, so this is not malware; the main issue is transitive dependency and unpinned external runtime trust.