openspec-ff-change

SUSPICIOUS. The skill’s purpose and local file-writing behavior are coherent with OpenSpec artifact generation, but the execution path is inconsistent with official distribution: it uses unscoped `npx openspec` despite official docs naming `@fission-ai/openspec`, and an unrelated `openspec` package exists on npm. This is primarily a supply-chain trust issue, not evidence of malware or exfiltration.