notte

SUSPICIOUS. The skill’s core capabilities largely match its stated browser-automation purpose and its domains/packages appear official, so it is not outright malicious. However, it has a broad and high-impact footprint: it forwards API keys and optional site credentials to third-party SDK/services, performs authenticated browser actions, supports proxies/captcha solving, and can deploy scheduled hosted automations. The main internal inconsistency is the install guidance (`pip install notte`) versus the documented `notte_sdk`/`notte-sdk` hosted SDK flow. Overall this is a legitimate but high-trust skill with medium-high security risk due to autonomy and credential/data routing through the vendor.