speckit-plan

SUSPICIOUS: The skill’s purpose and core actions are coherent for a planning workflow, but it automatically executes repo-controlled hooks and scripts, creating moderate risk from malicious project configuration despite no direct evidence of credential theft or external exfiltration.