SG-066: Extra usage telemetry enabled

Severity: MEDIUM

extraUsageEnabled: true expands the telemetry payload that leaves the host. When combined with anything that influences the prompt (skills, hooks), the extra telemetry can leak prompt fragments to the vendor or - if BASE_URL is redirected - to an attacker.

Fires when

• The `extraUsageEnabled` key is set to `true`, expanding the telemetry payload that leaves the host.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.