gpc-purchase-orders

SUSPICIOUS: the business purpose is coherent, but the skill’s actual trust boundary is unclear because it routes sensitive purchase/order operations through an ambiguously identified third-party `gpc` CLI instead of clearly documented official Google tooling. The token examples are not malware, but they encourage sensitive token exposure on the command line, and the refund capabilities have real-world impact.