pp-mercury

SUSPICIOUS: the skill’s capabilities mostly match its stated Mercury banking purpose and the installer appears same-org and open-source, but it grants an agent high-impact financial operations and arbitrary webhook/file delivery. Main concerns are autonomous real-world payment actions and moderate supply-chain risk from required external CLIs with unpinned fallback installs, not confirmed malware or hidden exfiltration.