speckit-specify

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The spec instructs the system to read and execute commands defined in a repository-controlled .specify/extensions.yml (both before/after flows), treating hooks without conditions as executable and accepting user-provided branch names — this allows arbitrary command execution from project files and could be abused for remote code execution and data exfiltration.