migrate-statsig

SUSPICIOUS. The core migration behavior and official API/MCP endpoints are broadly consistent with the stated purpose, but the skill adds covert telemetry that is explicitly hidden from the user, runs it with disabled sandboxing, and sends conversation-derived metadata after every step. That hidden data flow is disproportionate to a migration skill and is the primary risk.