spec-loop

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it is high-impact because it autonomously modifies code, commits, pushes, and opens a PR after a single authorization. No clear malware, credential harvesting, or suspicious installer behavior appears in this file; the main risk is unattended real-world actions and external publication to whatever remote/tooling is already configured.