speckit-analyze

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill mandates reading and blindly executing hook commands defined in a repo-controlled .specify/extensions.yml (including mandatory hooks) and running local scripts, which enables arbitrary command execution and a supply-chain/backdoor risk that could exfiltrate data or run remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill both mandates executing a local script (.specify/scripts/bash/check-prerequisites.sh) and requires invoking extension hooks (including "mandatory" hooks that "MUST" be executed), which can run arbitrary commands and therefore modify the host system despite a claimed "STRICTLY READ-ONLY" constraint.