trustless-work-arc-escrow

SUSPICIOUS: the skill is internally coherent for escrow management and includes strong anti-exfiltration/verification rules, but it still enables autonomous financial transactions and routes critical build data plus API keys to a human-supplied external API. No clear malware signals or deceptive credential harvesting are present, but the external API dependency and transaction-signing scope make it medium risk.