web3-devkit-cli

SUSPICIOUS: the skill’s capabilities broadly fit its stated blockchain-dev purpose, and there is no clear credential harvesting or covert exfiltration. Main concerns are install-trust ambiguity for the unpinned global npm package, cross-org publishing mismatch, and the fact that the skill can drive real blockchain actions like deployments and wallet operations with reduced confirmation prompts.