nextpay

SUSPICIOUS: The skill’s purpose and requested operations are broadly coherent, but it depends on a remotely installed, insufficiently verifiable CLI that handles authentication and stores session credentials locally. The same-brand domain reduces concern somewhat, yet the pipe-to-shell installer, black-box credential handling, and transitive skill installation make this a high security-risk skill rather than clearly benign.