doordash

SUSPICIOUS: the skill’s purpose and file access are mostly coherent for family food ordering, and the approval gate is a meaningful safeguard, but it relies on an undocumented/unverifiable local dd-cli binary to perform authenticated ordering and card charging. That black-box executable and the real-world purchase capability make this a high security-risk skill even without clear evidence of malware.