pstack-pulse

SUSPICIOUS: the skill is mostly coherent with its stated notification purpose, but it has a broader footprint than a simple status helper. The main risks are deliberate off-host data flow to ActivitySmith, public exposure of session summaries through Tailscale Funnel, persistent hook/daemon installation, and execution of repo-local Node scripts for plan rendering. I do not see clear credential theft or confirmed malware, but the monitoring/exposure scope is medium risk and should be reviewed before use.