speckit-tasks

SUSPICIOUS: core task-generation behavior is coherent and uses local project artifacts, but the skill also auto-invokes mandatory hook commands sourced from project-local extension config. That transitive execution path is broader than simple document generation and raises medium risk, though there is no clear evidence of credential theft, remote exfiltration, or confirmed malware in the skill itself.