spec-driven-planning

SUSPICIOUS: The core behavior is mostly coherent for a planning skill—local file creation, requirements capture, and design drafting are proportional to purpose. Risk rises because it combines untrusted external research with write/bash tools and delegates to other unverified skills, while distribution trust relies on a third-party Playbooks `npx` path rather than a same-org official channel. No direct credential harvesting, exfiltration endpoint, dangerous pre-execution directive, or malicious payload is evident in the provided skill.