swiggy-prava-skill

SUSPICIOUS: The core Swiggy + Prava payment flow is mostly aligned with the stated purpose and targets official Swiggy/Prava services, so this is not confirmed malware. However, it enables autonomous real-world purchases, depends on external setup tooling, and references a Prava CLI that was not verified in official docs; combined with third-party npx-based MCP access, this creates medium-high security risk.