ucp

SUSPICIOUS: the skill is purpose-aligned and its network flows appear consistent with official Shopify/UCP commerce operations, but it requires an unspecified external `ucp` binary and authorizes autonomous purchase actions. The main risk is trust in an unverifiable required CLI plus real-world transaction capability, not clear evidence of credential theft or malicious exfiltration.