xianyu-goofish-listings-scraper

SUSPICIOUS: the stated scraping purpose is coherent, and the BrowserAct install source appears publisher-aligned, but the skill is materially riskier than it sounds because it auto-installs a separate skill and external CLI without confirmation, expanding trust to a transitive browser-automation runtime. Main concerns are transitive installation and autonomous dependency setup rather than clear malware or credential theft.