mortgage-broker-lead-scraper

SUSPICIOUS: the stated purpose is plausible, but the skill’s actual footprint is broader than a simple scraper because it auto-installs and delegates execution to a separate third-party skill/CLI. The BrowserAct dependency appears legitimate and same-org documented, so this is not confirmed malware, but the transitive trust chain, autonomous installation, and browser-based processing of untrusted content make it medium-high risk.