indeed-job-lead-scraper

SUSPICIOUS: the stated purpose mostly matches browser-based lead scraping, and the BrowserAct dependency appears same-org and officially documented, so this is not confirmed malware. However, the skill’s automatic installation of a separate skill/CLI without user confirmation creates a meaningful transitive-trust and autonomy risk, and live web browsing introduces prompt-injection exposure.