test-spec-gen

SUSPICIOUS. The core behavior mostly matches a test-spec generation workflow, but the skill is broader than necessary: it inspects local Claude config, uses external research providers for project-derived context, suppresses detailed user visibility during execution, and installs a transitive trust chain through other skills. No direct malware indicators, credential theft, or malicious installer path are present, but the data exposure and hidden-action posture make it higher risk than a normal documentation skill.