speckit-implement

SUSPICIOUS: the core implementation behavior is broadly aligned with the stated purpose, but the skill has medium risk because it lets repo-controlled files and extension hooks steer an agent that can edit files and invoke commands. No clear credential theft, remote exfiltration, or malicious installer behavior is present, but automatic hook execution and untrusted-content-driven actions expand the skill beyond a simple task executor.