openspec-apply-change

SUSPICIOUS: The skill’s purpose and capabilities mostly align, and it requests no disproportionate credentials or exfiltration paths. The main risk is install/execution trust: using `npx openspec` targets an ambiguous unscoped npm package instead of the official scoped package or documented installed CLI, creating a meaningful supply-chain risk.