speckit-implement

SUSPICIOUS: the core skill is mostly coherent for local implementation automation and shows no direct exfiltration or malicious install path, but it delegates execution to extension hooks from local config, creating a transitive trust chain. The main risk is autonomous execution of unreviewed Speckit extensions rather than this skill's own instructions.