collector-diagnostics

Purpose and data flows are mostly coherent with a diagnostics skill, and the documented handling of the collector secret is constrained. The main concern is execution trust: the skill passes a live credential to an unpinned `bunx usagemax@latest` package whose first-party provenance was not independently verified, so this is best classified as suspicious/medium risk rather than benign.