smart-shopping

SUSPICIOUS. The stated purpose matches shopping research on JD/Taobao, and no obvious attacker-controlled endpoint or remote installer is shown, but the skill’s main mechanism is collecting and reusing raw account cookies through chat. That credential scope is high for the task, the claimed secure local storage is unverifiable, and the core implementation file is missing, so the trust boundary is unclear.