commercevault-edd-commerce-orchestrator

SUSPICIOUS: The skill’s stated commerce purpose matches its API capabilities, but install trust is weak. The branding/source mismatch, unverified package publication, and forwarding of EDD credentials to a third-party CLI make the footprint disproportionally risky; the TLS-disable example adds further security concern. No confirmed malicious payload or covert exfiltration is shown, but this should not be treated as benign.