ups-cli

SUSPICIOUS. The business purpose is plausible for UPS workflows, but the skill’s actual trust model is not coherent with official UPS evidence: it relies on an unverified `ups` CLI with no documented install source and uses a credential pattern that does not match UPS’s current OAuth-based documentation. Because a black-box CLI would receive sensitive credentials and can perform real-world shipping actions, this skill carries high security risk despite having a plausible stated purpose.