openspec-archive

SUSPICIOUS. The core archive behavior is coherent with an OpenSpec workflow, but the skill’s footprint is broader than necessary: it introduces a separate third-party CodeGraph CLI, can trigger transitive skill execution, and optionally performs external PR creation. No direct credential theft or exfiltration is evident, but install-trust and action-scope risks make it higher than a simple archival helper.