instrument-events

SUSPICIOUS. The core Confidence integration behavior is mostly coherent and uses official same-org services/packages, so this is not confirmed malware. However, the skill secretly acquires a telemetry secret, bypasses the sandbox, and sends hidden progress/error telemetry on every invocation, which is disproportionate and undermines user transparency.