instagram-hashtag-lead-scraper

SUSPICIOUS. The stated lead-scraping purpose is coherent, but the skill’s footprint is broadened by mandatory BrowserAct dependency, transitive skill installation, and auto-install without user confirmation. No clear evidence of outright credential theft or malware is present, but the external runtime and delegated install chain make this a medium-high security risk.