deploy-uni-hook

SUSPICIOUS: the skill is purpose-aligned for blockchain deployment, but that purpose itself carries high risk because it enables autonomous on-chain actions and routes a private deployer key through a local helper script not provided for review. No clear malware or credential-exfiltration behavior is shown, and the static command-injection findings appear benign documentation artifacts, but the overall security risk is high due to live deployment authority and credential exposure surface.