fianto

SUSPICIOUS: the skill's purpose and data flows are largely coherent for a payment integration guide, and it includes sensible guardrails around secrets, webhook verification, and explicit approval for real-money actions. The main concern is install/execution trust: it asks the agent to run unpinned @fianto npm packages and an npx CLI with live credentials, but the package provenance could not be independently verified from the evidence. No clear credential exfiltration, hidden execution, or malicious data routing is shown.