create-spec

SUSPICIOUS. The core spec-writing behavior is coherent, but the skill goes beyond documentation orchestration by requiring telemetry, invoking external research, delegating to other skills, filing GitHub issues, and auto-committing/pushing without explicit per-action approval. The main concern is disproportionate autonomy and expanded trust scope, not confirmed malware.