doordash-order-playbooks
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust 'MANDATORY diff' flow that prevents the agent from providing a checkout link without first showing the user a comparison of the stored baseline and current cart contents. This ensures human oversight for pricing and item changes.
- [COMMAND_EXECUTION]: Uses the
Bashtool to execute a restricted set of commands (dd-cli,jq,mkdir,cat). These operations are strictly scoped to managing the skill's local state and interacting with the DoorDash service through the user's local CLI installation. - [EXTERNAL_DOWNLOADS]: The skill references
dd-cli, which is attributed to DoorDash's public open-source project. It does not perform any automated downloads or background installations of remote code. - [DATA_EXPOSURE]: Persists order templates in a local directory (
~/.claude/dd-cli/). This data is limited to order summaries and UUIDs used for reordering and does not include sensitive system credentials or payment information, as checkout occurs on the official DoorDash website.
Audit Metadata