ordercli

SUSPICIOUS: mostly coherent with a food-order CLI, but it handles credentials/cookies through a third-party binary and supports cart-changing actions. Install provenance looks same-owner and reasonably consistent, so this is not clearly malicious, but the credential scope and browser-session import make it higher risk than a simple read-only status skill.