gait-session-tracking

SUSPICIOUS: the stated purpose is coherent for session auditing, and the skill does not directly exfiltrate data or request unrelated credentials. The main risk is supply-chain/delegated execution: all functionality is handed to an external MCP script selected by environment variable, with unclear first-party provenance and no verification guidance, making this a high trust dependency rather than confirmed malware.