thepeer

SUSPICIOUS. The skill is internally coherent and uses an official same-org npm CLI, so it is not malware-like. However, it routes sensitive financial-service operations and credentials through Membrane rather than directly to Thepeer, uses mutable `@latest` installs, and enables potentially consequential payment actions; this makes it medium risk and appropriate only with strong user approval boundaries.