pr402-buyer

SUSPICIOUS. The skill’s payment-signing and purchase capabilities match its stated buyer purpose, but it enables autonomous real-world spending and relies on fragmented third-party infrastructure and package provenance. This is not confirmed malware, yet it carries meaningful financial and supply-chain risk.