speckit-converge

SUSPICIOUS: the core converge behavior is consistent with the skill’s purpose and official Spec Kit workflow, but automatic execution of repository-controlled mandatory hooks expands its footprint beyond simple analysis/appending. No evidence of credential theft, hidden exfiltration, remote installers, or malicious pre-execution syntax was found; the main risk is trust in local hook commands defined by the repo.