commercevault-edd-ecommerce-orchestrator

SUSPICIOUS. The skill is mostly a documentation-style EDD integration guide, and the flagged command patterns are harmless examples. Risk comes from install trust and internal consistency: the publisher/repo relationship is unclear, the dependency manifests are not verifiably pinned from the provided evidence, and several claimed write capabilities do not match EDD's documented REST API scope. No clear credential exfiltration or malicious payload is shown.