prava-shopping

SUSPICIOUS: The skill's shopping and payment capabilities largely match its stated purpose and include meaningful user-approval checkpoints, but it enables autonomous real-world purchasing and relies on a CLI package whose exact official npm provenance was not fully verified from the supplied evidence. This looks coherent but high-impact, with moderate supply-chain and credential-handling risk rather than confirmed malicious behavior.