mercadona-cli-shopping

SUSPICIOUS: the skill is broadly aligned with grocery automation, but its footprint is higher risk than a typical shopping helper. Main concerns are third-party CLI trust (especially raw GitHub pipe-to-shell), browser-session token extraction, durable credential storage, and autonomous real-world order submission. No clear evidence of credential exfiltration beyond Mercadona, so this is not confirmed malware.