paythefly

SUSPICIOUS: the stated purpose is plausible, but the provided skill is extremely minimal and installs through an unpinned remote CLI (`npx ...@latest`). The installer appears tied to the same ecosystem, which lowers concern versus a random third-party binary, but this is still a supply-chain risk. Because the skill is for crypto payment and withdrawal links, the real-world financial impact is high, yet the snippet provides no detail on credentials, approval boundaries, or data flows. No confirmed credential theft or malicious behavior is visible from the supplied text alone.