push-notifications

SUSPICIOUS rather than malicious. The core push-notification capabilities and credential needs largely match the stated purpose, and install sources are mostly official or well-known. The main risks are autonomous execution without approval, transitive skill invocation, broad file modification, and out-of-scope telemetry writes to ~/.claude/projects.