follow-graph-spec

SUSPICIOUS: the stated purpose is coherent, but the install/execution trust is not. The skill’s footprint is otherwise narrow and proportionate, yet it depends on repeatedly executing an unpinned `npx graph-spec-cli` package whose official provenance was not verified from the evidence, creating a significant supply-chain risk even without signs of overt malware or data exfiltration.