facebook-ad-library-lead-scraper

SUSPICIOUS. The core scraping purpose is plausible, and the BrowserAct dependency has same-org documentation and PyPI presence, so this is not confirmed malware. However, the skill is overly broad for its stated purpose and, more importantly, instructs the agent to auto-install another skill and CLI without user confirmation, creating medium-high transitive trust and autonomy risk.