tracking-resource-usage

SUSPICIOUS: the skill’s purpose and requested telemetry are broadly coherent, but it relies on an externally named plugin with no verifiable provenance, version pinning, checksum/signature, or official distribution evidence in the skill text. That makes the install/execution trust weak enough to treat this as a supply-chain risk even without signs of overt credential theft or exfiltration.