expect-test

SUSPICIOUS: the core browser-testing behavior aligns with the stated purpose, and the main CLI source appears official, but the skill expands into artifact publication, PR commenting, and transitive skill/tool usage. The biggest risk is exfiltration of replay artifacts and autonomous public posting, not overt malware.