megadev-performance

SUSPICIOUS. The skill’s stated profiling purpose is coherent and the included Python script is benign, but the execution path relies on an unverified third-party `latest` Docker image (`ewrogers/megadev`) while the documentation cites a different upstream project (`drojaazu/megadev`). That provenance mismatch makes the install footprint riskier than the stated purpose requires, even though there is no clear credential theft or exfiltration behavior in the visible content.