zomato-order

SUSPICIOUS: the skill is broadly aligned with its stated purpose and uses official tooling, but it normalizes persistent session-cookie reuse for a consumer account and stores those tokens in plain files under /tmp. There is no clear third-party exfiltration or malicious installer, so this looks more like a risky automation pattern than malware.