Doordash

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkDeclared4 observations
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Do NOT search for the script, inspect it, or try to discover how the CLI works. Just run the commands as documented below.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/doordashThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Order food, groceries, and convenience items from DoorDash using the built-in CLI integration

---
name: doordash
description: Order food, groceries, and convenience items from DoorDash using the built-in CLI integration
compatibility: "Designed for Vellum personal assistants"
metadata:
  icon: assets/icon.svg
  emoji: "🍕"
  vellum:
    category: "commerce"
    display-name: "DoorDash"
---

You can order food from DoorDash for the user using the DoorDash CLI script.

## CLI Setup

**IMPORTANT: Always use `host_bash` (not `bash`) for all DoorDash commands.** The DoorDash CLI needs host access for Chrome CDP and session cookies - none of which are available inside the sandbox.

The DoorDash CLI is invoked via `bun {baseDir}/scripts/doordash-entry.ts`. Do NOT search for the script, inspect it, or try to discover how the CLI works. Just run the commands as documented below.

## Task Progress Widget

A task progress card is shown automatically when you run your first DoorDash command. Its surface ID is `doordash-progress`. As each step completes, call `ui_update` with surface ID `doordash-progress` to update step statuses. Update `data.templateData.steps` - set completed steps to `"status": "completed"` with a `"detail"` string, the current step to `"status": "in_progress"`, and future steps to `"status": "pending"`. Adapt the steps to the actual flow (e.g. skip "Search restaurants" if the user named a specific store).

## Typical Flow

When the user asks you to order food (e.g. "Order pizza from Andiamo's"):

1. **Check session** - run `bun {baseDir}/scripts/doordash-entry.ts status --json`. If `loggedIn` is false or the session is expired, inform the user that their DoorDash session has expired and they need to log in again.

2. **Search** - run `bun {baseDir}/scripts/doordash-entry.ts search "<query>" --json` to find matching restaurants. Present the top results to the user with name, rating, and delivery info. If the user named a specific restaurant, pick the best match. If ambiguous, ask.

3. **Browse menu** - run `bun {baseDir}/scripts/doordash-entry.ts menu <storeId> --json` to get the menu. Show the user the categories and items with prices. If the user already said what they want (e.g. "pepperoni pizza"), find the matching item(s). **For convenience/pharmacy stores** (CVS, Duane Reade, Walgreens etc.), the response will have `isRetail: true` and empty items - use `store-search` instead (see step 3b).

3b. **Search within a retail store** - for convenience/pharmacy stores, run `bun {baseDir}/scripts/doordash-entry.ts store-search <storeId> "<query>" --json` to find specific products. This returns items with IDs, prices, and menuIds that can be added to cart directly.

4. **Get item details** (if needed) - run `bun {baseDir}/scripts/doordash-entry.ts item <storeId> <itemId> --json` to see options/customizations. The response includes:
   - `options`: each option group has `minSelections`/`maxSelections` indicating how many choices are required
   - Each choice has `unitAmount` (price impact in cents), `defaultQuantity`, and possibly `nestedOptions` (sub-choices like milk type within a size selection)
   - `specialInstructionsConfig`: whether special instructions are accepted, max length, and placeholder text

   If the item has required options (like size or toppings), construct the `nestedOptions` JSON from the option/choice IDs and pass it via `--options`. Ask the user for preferences or pick sensible defaults.

5. **Add to cart** - run `bun {baseDir}/scripts/doordash-entry.ts cart add --store-id <id> --menu-id <id> --item-id <id> --item-name "<name>" --unit-price <cents> [--options '<json>'] [--special-instructions "<text>"] --json`. For subsequent items at the same store, pass `--cart-id <id>` from the first add response. Use `--special-instructions` for requests like "extra hot", "no ice", etc. Use `--options` to pass customization choices (see Customization Options below).

6. **Review cart** - run `bun {baseDir}/scripts/doordash-entry.ts cart view <cartId> --json` and show the user what's in their cart with prices. Ask if they want to add anything else or proceed.

7. **Checkout** - run `bun {baseDir}/scripts/doordash-entry.ts checkout <cartId> --json` to get delivery options. Present them to the user.

8. **Payment methods** - run `bun {baseDir}/scripts/doordash-entry.ts payment-methods --json` to see saved cards. Show the user which card will be used (the default one).

9. **Place order** - after the user explicitly confirms, run `bun {baseDir}/scripts/doordash-entry.ts order place --cart-id <id> --store-id <id> --total <cents> [--tip <cents>] [--dropoff-option <id>] --json`. The command auto-selects the default payment method if `--payment-uuid` is not provided. The response contains `orderUuid` on success.

## Important Behavior

- **Always confirm before checkout.** Never place an order without explicit user approval.
- **Be proactive.** If the user says "order pizza from Andiamo's", don't ask clarifying questions upfront - search, find the store, show the menu, and suggest items. Only ask when you need a choice the user hasn't specified.
- **Handle expired sessions gracefully.** If any command returns `"error": "session_expired"`, inform the user that their DoorDash session has expired and they need to log in again.
- **Show prices.** Always show prices when presenting items or the cart summary.
- **Use `--json` flag** on all commands for reliable parsing.
- **Do NOT use the browser skill.** All DoorDash interaction goes through the CLI, not browser automation.
- **Rate limiting.** DoorDash rate-limits rapid sequential requests. When adding multiple items (e.g. a team order), wait 8–10 seconds between `cart add` calls. If you get a 403 error, wait 15–20 seconds and retry.
- **Special instructions are unreliable.** Some merchants disable special instructions entirely. Always prefer `--options` for customizations (size, milk type, etc.). Only use `--special-instructions` for free-text requests that aren't covered by the item's option groups. If the merchant rejects sp

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   !CAUTION B 89 / 100

   first audit · source 19bc86343b63

Questions about Doordash

• github.com/vellum-ai/vellum-assistant/tree/main/skills/doordash — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology