accounting-firm-lead-scraper

SUSPICIOUS: the stated purpose is plausible, but the skill is mostly a wrapper that auto-installs and delegates to BrowserAct. The main risk is transitive trust and autonomous dependency installation, plus possible forwarding of browser session or API-key context to third-party runtime tooling. Data flows appear brand-consistent rather than overtly exfiltrative, so this is not confirmed malware.