setup-bayarcash

SUSPICIOUS: the main Bayarcash documentation and PHP SDK references are coherent and mostly benign, but the skill also promotes an MCP path that is not clearly first-party, uses a transitive npx/Smithery install chain, and forwards Bayarcash credentials into third-party code. Direct API/SDK guidance fits the skill's purpose; the MCP tooling meaningfully increases security risk and makes the overall skill only partially aligned and higher-trust than necessary.