facebook-post-lead-scraper

SUSPICIOUS: the stated lead-scraping purpose broadly matches the capability, but the skill offloads execution to a third-party browser automation dependency and instructs autonomous installation without user confirmation. No clear credential theft or malicious exfiltration is shown in this skill alone, yet the transitive trust and browser-session access make it medium-high risk.