spec-lock

SUSPICIOUS. The stated purpose is coherent with local file read/write behavior, but the skill’s core functionality relies on an unverifiable local script with no trusted distribution path or publisher proof. No clear exfiltration is shown, yet install/execution trust is weak enough to make the skill medium-high risk.