cs-build-plan-app

SUSPICIOUS: the skill is largely coherent for app-planning, but its footprint is broader than necessary because it combines shell access, SaaS writes, web ingestion, and downstream skill handoffs. The CodeSpring CLI install path appears same-org and proportionate, so the main concerns are transitive trust and prompt-injection exposure rather than confirmed malware.