nextpay

SUSPICIOUS: the business-management purpose is coherent, but the trust model is not. The skill chains into another skill install and then installs an unverifiable CLI via pipe-to-shell; that CLI receives authentication input and stores session credentials locally while enabling privileged account actions. This is a high supply-chain and credential-forwarding risk even without proof of malicious intent.