tracekit-go-sdk

SUSPICIOUS: mostly coherent observability guidance with same-org Go SDK install and vendor-domain telemetry, but the skill expands scope via an unverified local auth script, mandatory transitive use of another skill, and default code-monitoring/optional LLM content capture that can export sensitive data. Not confirmed malicious, but risk is above benign due to credential/bootstrap ambiguity and data sensitivity.