vinted-marketplace-scraper

SUSPICIOUS: the stated scraping purpose is coherent, but the skill’s automatic no-confirmation installation of an external skill/CLI introduces transitive trust and moderate execution risk. Evidence suggests the dependency source is official BrowserAct infrastructure, so this looks more like a risky dependency model than confirmed malicious behavior.