facebook-group-member-lead-scraper

SUSPICIOUS: the skill’s purpose and scraping behavior are aligned, but it materially expands trust by auto-installing a separate BrowserAct Skill and CLI without user confirmation. Provenance looks same-brand and PyPI-backed rather than obviously malicious, so this is not confirmed malware, but the transitive dependency, autonomous installation, and browser-session/cookie handling make it a medium-high security risk.