google-maps-storefront-lead-scraper

Mostly aligned lead-scraping skill with no clear malware indicators, but it has meaningful risk because it auto-installs and invokes a separate BrowserAct skill/CLI without separate approval. Official same-org/PyPI provenance keeps supply-chain risk moderate rather than high, but the transitive install and autonomous browser execution make it suspicious rather than fully benign.