cost-tracking

SUSPICIOUS. The core skill is mostly coherent for billing analysis and uses official Anthropic/Vercel APIs, but the optional Vantage MCP path is a meaningful trust and data-flow risk: it adds a third-party service, forwards high-privilege Anthropic admin credentials, and creates transitive integration risk not required for the stated purpose. No confirmed malware or hidden payloads are present, but the credential-forwarding and external MCP setup make this skill medium-high risk.

High-risk supply-chain artifact. The embedded instructions describe a telemetry pipeline that collects token/billing/usage metrics using API credentials and forwards derived data to external webhook/collector endpoints. It also contains repeated adversarial/C2-style and credential-misuse framing that is inconsistent with benign cost tracking. Treat as unsafe and investigate/quarantine the real package contents, install scripts, and any runtime entrypoints.