speckit-analyze

SUSPICIOUS: the core analysis purpose is coherent and mostly read-only, but automatic execution of project-defined mandatory hooks creates a disproportionate trust boundary. Risk depends on what extensions are installed in .specify/extensions.yml; the skill delegates command execution to that local extension chain without independently verifying provenance.