compose-vrf

SUSPICIOUS: the core VRF/deployment behavior is consistent with the stated purpose, and crypto/on-chain functionality belongs in this skill, but it carries meaningful operational risk because it installs or loads additional tooling/skills and can autonomously deploy apps and submit blockchain transactions. Data flows are mostly coherent and official, so this looks more like a high-impact deployment skill than credential-harvesting malware.