tiktok-comment-lead-scraper

SUSPICIOUS: the stated purpose is coherent with lead scraping, but the skill’s footprint is enlarged by mandatory auto-install of a transitive BrowserAct skill and external CLI without separate approval. Same-brand provenance lowers concern versus a random payload, but transitive installation, autonomous execution, and limited CLI transparency make this medium-to-high risk rather than benign.