prospect-contact-verification

SUSPICIOUS: the stated purpose is coherent, but the skill offloads its core behavior to BrowserAct, instructs automatic installation without separate approval, and introduces a transitive trust chain plus possible browser-session exposure. Evidence suggests BrowserAct is likely legitimate rather than malicious, so this is not confirmed malware, but the operational and supply-chain risk is high enough to treat the skill as risky.