google-maps-business-lead-scraper

SUSPICIOUS. The stated purpose matches browser-based lead scraping, but the skill materially expands trust by auto-installing and delegating execution to the external BrowserAct skill/CLI without user confirmation. Install provenance is partially reassuring because BrowserAct's docs, GitHub org, and PyPI package appear aligned, so this is not confirmed malware; however, transitive skill installation, autonomous dependency setup, and opaque external runtime behavior make the overall security posture medium-high risk.