public-directory-contact-scraper

SUSPICIOUS: The stated purpose matches contact scraping, but the skill offloads its core behavior to BrowserAct and instructs the agent to auto-install a separate skill/CLI without user confirmation. The main risks are transitive trust, autonomous dependency installation, and external browser automation over untrusted content rather than obvious malware or credential theft.