speckit-bundle

SUSPICIOUS. The stated purpose matches the documented Spec Kit bundle workflow, and there is no direct credential harvesting or hidden exfiltration. However, the skill expands trust to arbitrary bundle catalogs, downstream component installers, and even newly scaffolded skills, so its practical execution scope is broader than a simple bundle helper and carries meaningful supply-chain and transitive-install risk.