Add opt-in anonymous telemetry ping

[DUBSOpenHub]

Adds a lightweight telemetry ping to track skill usage anonymously.

Pings dubsopenhub.github.io/skill-telemetry/ping/dark-factory.gif on invocation.
Users can opt out by setting COPILOT_SKILL_TELEMETRY=off.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[DUBSOpenHub]

Flagging this rather than merging — there are a few problems, one of which makes it non-functional regardless of the policy question.

It doesn't work. DUBSOpenHub/skill-telemetry is a private repo, and raw.githubusercontent.com returns 404 for private content without a token:

$ curl -s -o /dev/null -w '%{http_code}' https://raw.githubusercontent.com/DUBSOpenHub/skill-telemetry/main/docs/ping/dark-factory.gif
404

So this has always been a dead beacon. Even if the repo were public, a GIF fetch is presence-only — no version, no outcome, no way to tell a real run from a CI run — which is not much signal for the cost below.

It's opt-out, not opt-in. The title says opt-in, but the implementation runs unless COPILOT_SKILL_TELEMETRY=off is already set. Defaulting to on and requiring a variable nobody knows exists is the opposite of consent.

The shape is the real issue. silently ... without showing output to the user + a backgrounded curl to a .gif with > /dev/null 2>&1 is, line for line, what a supply-chain prompt injection looks like. That matters more here than in most repos: this skill's entire premise is adversarial verification, and it asks people to hand it their codebase. An instruction telling the agent to hide a network call from the user undercuts that, and anyone auditing the skill will find it.

It also runs against the repo's own constraints — copilot-instructions.md scopes this repo to markdown/YAML with no runtime execution, and the CI validator is the single declared exception.

Finally, this is BEHIND and targets a section of SKILL.md that #27 rewrites, so it would need a rebase in any case.

If usage numbers are genuinely wanted, the honest version is opt-in (default off), fetched from a public endpoint, disclosed in the README, and visible in the run output rather than suppressed. Happy to put that together if useful. Leaving this open for your call.

[DUBSOpenHub]

Closing this — the goal is reasonable but this implementation can't achieve it, and the repo already has the data.

It could never have worked. DUBSOpenHub/skill-telemetry is private, so raw.githubusercontent.com returns 404 without a token. The beacon has been dead since it was written.

It's also redundant. GitHub's traffic API already reports what this was reaching for, and with better fidelity. Last 14 days on this repo: 34 views / 27 unique, and 19 clones / 15 unique. For a skill, a clone is effectively an install — so roughly 55% of unique visitors install it, which is a far more useful number than a presence ping, and it arrives with referrer and path breakdowns a GIF fetch can never provide.

And the shape was the real problem. silently ... without showing output to the user plus a backgrounded curl with output suppressed is, line for line, what a supply-chain injection looks like. That matters more here than in most repos, since this skill asks people to hand it their codebase and its entire premise is adversarial verification.

Worth noting it was also opt-out despite the title, and it targets a section of SKILL.md that #27 has now rewritten, so it would need a full rebase regardless.

If richer usage data is still wanted, the honest version is opt-in by default, a public endpoint, disclosed in the README, and visible in run output rather than hidden. Happy to build that separately.