web-performance-core-web-vitals

SUSPICIOUS: the skill content itself is a harmless performance guide, but it primarily distributes itself through transitive skill installation from a personal third-party repo. No credential access, exfiltration, or hidden behavior is present, so this is not malware; the main concern is install-trust and mutable third-party skill loading.