reddit-comment-lead-scraper

SUSPICIOUS. The stated purpose matches Reddit lead scraping, but the skill is riskier than necessary because it auto-installs a separate skill/CLI and may operate with browser cookies and authenticated session context. BrowserAct looks like a legitimate same-org dependency rather than an obvious malicious payload, so this is not confirmed malware; the main concerns are transitive trust, autonomous installation, and broad browser-data access.