grocery-cart

SUSPICIOUS: the skill's shopping-cart behavior is broadly aligned with its stated purpose, but it introduces meaningful trust and privacy risk through transitive skill/MCP installation and routing store auth/cart activity through Peristyle-controlled services. The confirmation gate limits abuse, so this looks more like a third-party commerce integration with medium risk than confirmed malware.