commercevault-edd-digital-commerce

SUSPICIOUS: The skill’s commerce purpose matches the requested EDD credentials and data access, but the trust chain is inconsistent. Claimed publisher, package/image names, and cited source repo do not clearly match, and the middleware model forwards store credentials and customer/order data through third-party code rather than a clearly verified same-org official client. No direct exfiltration or overt malware is shown, but provenance and credential-routing concerns make this medium/high risk.