sgdk-performance

SUSPICIOUS: the skill's purpose and capabilities are mostly coherent and there is no credential harvesting or exfiltration, but it relies on a third-party Docker image with write access to the user's workspace rather than the upstream official SGDK container path. Digest pinning lowers supply-chain risk, yet the install/execution trust is still medium because users must trust an external image to build local code.