mmk-paymint

SUSPICIOUS. The skill’s purpose matches its billing capabilities, but it relies on an unverifiable private CLI and enables consequential payment/refund actions. The fragment shows no direct exfiltration or overtly malicious behavior, yet the required black-box executable creates a high supply-chain risk.