speckit-clarify

SUSPICIOUS: the core clarify/edit behavior matches the stated purpose, but automatic execution of repository-configured hooks makes the skill broader than a simple Q&A spec helper. No third-party download, credential request, or exfiltration path is shown, so this is not malicious; the main risk is trusted execution of repo-local commands via extensions.yml.