xiaohongshu-rednote-creator-discovery

SUSPICIOUS. The stated purpose matches creator discovery, and there is no direct credential theft or unrelated access in this skill. The main issue is proportional trust: it tells the agent to automatically install a separate BrowserAct skill/CLI and defer live behavior to that external runtime, which is same-org and plausibly legitimate but still a meaningful transitive supply-chain risk.