speckit-plan

SUSPICIOUS: the core planning purpose is coherent, but automatic execution of project-configured mandatory hooks gives the repository control to trigger additional local commands/skills. With no external installs, credential handling, or off-platform data flows, this is a medium-risk transitive-trust/autonomous-execution issue rather than confirmed malware.