generate-spec

SUSPICIOUS: the skill’s core behavior matches its purpose, but it relies on an unpinned third-party `npx` package and can publish repo-derived spec content externally through gist/diffmap. This is not fundamentally malicious, yet it introduces medium supply-chain and data-sharing risk that should be user-approved before use.