product-hunt-launch-lead-scraper

SUSPICIOUS: the stated lead-scraping purpose is plausible, but the skill’s footprint is broader than necessary because it auto-installs and delegates to another skill/CLI at runtime without user confirmation. The install source appears same-org and not overtly malicious, so this is better classified as medium security risk from transitive trust, runtime-fetched behavior, and browser-based external-content exposure rather than confirmed malware.