perf-optimize-workflow

SUSPICIOUS. The workflow’s core performance-analysis content is coherent, but it contains a disproportionate transitive-install instruction that globally installs all skills from a third-party repo instead of only the two named dependencies. The CLI path is official, which lowers malware confidence, but the wildcard third-party skill installation materially raises security risk.