twitter-x-list-member-lead-scraper

SUSPICIOUS: the skill’s purpose matches scraping leads from X/Twitter, but it delegates execution to an external BrowserAct skill/CLI, auto-installs that dependency without user confirmation, and creates a transitive trust chain with possible cookie/account-context exposure. The install sources appear same-brand and partly verifiable, so this is not confirmed malware, but the autonomy and third-party runtime dependence make the skill medium risk.