apply-grant

SUSPICIOUS. The core purpose is coherent with the requested project files, git history, and user profile fields, but the skill’s footprint is broader than necessary because it executes an unverified local helper script and exports full AI session transcripts for attachment. Telemetry is opt-in/opt-out and limited in scope, yet its network destination is only a configurable Convex URL rather than a fixed verified service endpoint. No clear credential harvesting or confirmed malware behavior is present, but privacy and trust risks are material.