payping

SUSPICIOUS. The skill's capabilities fit a PayPing account integration and its normal network destinations are PayPing's official APIs, but it relies on an unofficial third-party MCP package and forwards a sensitive merchant token into that code. This is a coherent integration with moderate supply-chain and credential-trust risk rather than confirmed malware.