browse

SUSPICIOUS: the browsing capability itself fits the stated QA purpose, and the Bun installer path is official with checksum pinning, but the skill's actual footprint is much broader than a browser tool. It performs telemetry, artifact sync, config changes, CLAUDE.md injection, and git commits via local gstack binaries, creating medium risk from scope creep and opaque same-suite executables rather than clear malware or credential theft.