wellfound-startup-lead-scraper

SUSPICIOUS: the stated scraping purpose is plausible, but the skill’s footprint is broadened by automatic dependency installation, transitive skill loading, and execution of an external browser automation CLI. The referenced sources appear same-org and official rather than overtly malicious, so this is not confirmed malware; however, the no-confirmation install behavior and trust expansion make it medium-to-high risk for an AI agent environment.