social-viral-content-finder

SUSPICIOUS. The skill’s purpose aligns with its browser automation capability, and the BrowserAct dependency appears to be an official same-org tool rather than an unrelated payload. However, it directs the agent to auto-install a transitive dependency without confirmation and relies on a redirect-based trust chain and dynamic runtime instructions, which makes execution trust broader than a simple documentation skill. No clear exfiltration or credential-harvesting behavior is shown here, so this is not malicious, but it carries medium supply-chain and autonomy risk.