apply-grant

SUSPICIOUS. The core purpose is coherent, and requested user fields match a grant application, but the skill’s footprint is broader than necessary because it exports full AI session transcripts and runs an unseen local helper script. Telemetry is partly consent-gated and not obviously credential-harvesting, yet the configurable Convex endpoint and transcript handling create medium privacy and data-exposure risk.