pp-amazon-orders

SUSPICIOUS. The skill's core capabilities mostly match its stated purpose, and the same-org install paths reduce supply-chain concern, but it still requires trusting an external CLI with browser-session cookies and sensitive order history. Optional arbitrary webhook delivery and env-configured feedback posting create meaningful exfiltration risk for personal data, so this is not malicious but is higher-risk than a typical read-only documentation skill.