browser-work

SUSPICIOUS: the skill's core behavior matches its browser-automation purpose, but it combines arbitrary web-content processing with autonomous live-site actions and an npx-fetched helper package whose exact package provenance was not fully verified. I do not see clear credential theft or exfiltration, so this is not confirmed malware, but it is a medium-high risk skill for unintended actions or site-driven manipulation.