openspec-continue-change

SUSPICIOUS. The skill’s purpose and local file operations are consistent with an OpenSpec workflow, but its install/execution trust is not: it invokes `npx openspec` even though the official CLI is published under `@fission-ai/openspec`. That mismatch creates a significant supply-chain risk because `npx` may download and run an unrelated npm package that can control outputs and file writes.