agent-agentic-payments

SUSPICIOUS. The skill’s payment capabilities fit its stated purpose, but its trust and data-flow model are under-specified for a financial tool: it routes payment operations through an unnamed MCP backend, appears to send raw private keys for signing, and enables autonomous financial actions without explicit approval safeguards. This is not confirmed malware, but it is high-risk and disproportionate unless the backend provenance and key-handling model are independently verified.