doordash-order-ledger

SUSPICIOUS: the skill’s core behavior is a benign local audit-log/reporting guide, and its data flow is mostly local with no direct exfiltration. However, its permissions are broader than its stated purpose because dd-cli:* could enable live ordering actions, and it explicitly relies on installing additional unreviewed hook/command components, so the footprint is not fully proportionate to a ledger-only skill.