spec-kit

SUSPICIOUS: mostly coherent wrapper around GitHub's official spec-kit, but it carries medium supply-chain risk from mutable Git-based installs and an unnecessary transitive trust step that installs this skill from a third-party repo. No evidence of credential theft or exfiltration, so this is not malicious; the main issue is broadened installation trust beyond what the stated purpose requires.