mayar-v2

SUSPICIOUS: the skill’s payment/admin capabilities fit its stated purpose and data mainly flows to official Mayar endpoints, but it relies on repeated unpinned `npx @latest` execution and forwards API credentials into external CLI code. This is a supply-chain and credential-handling risk, not clear malware.

No clear malware/backdoor behavior is evident in the shown code fragment. The main security weaknesses are missing (or not shown) webhook signature/HMAC verification for integrity and a non-durable/incomplete idempotency mechanism that can lead to duplicate fulfillment after restart (and possibly crashes if `processed` is undefined). Additionally, console logging includes customer email and identifiers, creating potential privacy/compliance exposure. Risk may be mitigated if webhook verification and durable deduplication are implemented inside lib/mayar.ts or elsewhere, but that is not evidenced in this fragment.