perf

SUSPICIOUS: the profiling purpose is legitimate and most capabilities are proportionate, but the skill delegates to an external third-party performance-profiler agent, adding a transitive trust risk. The npm-based bundle visualizer usage is consistent with official docs and not itself suspicious, though unpinned `npx` execution adds low supply-chain risk. No credential harvesting or clear exfiltration is evident in the provided skill text.