pp-doordash

SUSPICIOUS. The skill’s capabilities broadly match its stated DoorDash automation purpose, but it relies on a non-official third-party CLI, forwards live DoorDash session credentials into that CLI, and supports arbitrary outbound webhook delivery plus purchase-capable mutations. The main risk is credential forwarding and external-binary trust, not confirmed malware.