ios-sync

SUSPICIOUS. The core regeneration capability is legitimate for the stated purpose, and the helper tooling appears to come from the same public gstack project. But this skill's actual footprint is far broader than ios-sync: it performs telemetry, artifact sync, context recovery, CLAUDE.md routing injection, vendoring migration, and possible git commits. That makes the scope disproportionate and raises medium security risk, even without clear evidence of malicious intent.