sdd-apply — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd-apply (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implement tasks from SPECS_ROOT/changes/<name>/tasks.md. Check off each task as it completes.
SPECS_ROOTis resolved by thesddrouter before this skill runs. Replace.specs/with your project's actual specs root in all paths below.
sdd-apply.If `tasks.md` does not exist for the active change: STOP.
"No tasks to implement. Run sdd-propose first to create the change artifacts."Do not proceed without tasks.md.
Never reference ephemeral scaffolding in any persisted artifact.
Ephemeral scaffolding includes:
Task 7.4, T12)Group 8, G3)D12, design §4.2)These must not appear in:
Tasks, groups, and design-section IDs are scaffolding for the current change. Once archived, only the spec name persists — references to ephemeral IDs become meaningless noise to future readers. Name things after _what they do_, not where they came from in tasks.md or design.md. If you catch yourself writing "D12 wiring" or "Task 7.4 implementation," restate it in terms of the behavior or component being changed.
This applies whether or not the `commit-message` skill is available. When drafting a commit message during apply:
commit-message if it is loadable in this environment.type(scope): subject) that describes _what changed and why_, and apply the constraints above.tasks.md and implementation should begin or continuetasks.md exists — run sdd-propose firstsdd-verify, then sdd-sync, then sdd-archive.specs/changes/<name>/tasks.md — full task list.specs/changes/<name>/design.md — architectural decisions to follow.specs/changes/<name>/specs/ — delta specs for behavioral requirements.specs/specs/ — baseline specs for full context.specs/changes/<name>/proposal.md § User Stories and .specs/NORTH-STAR.md — the value this work serves.Each requirement's Serves: backlink names the stories it advances; these bound scope (see The story ceiling below).
references/sdd-change-formats.md § 4 — each task should depend only on capabilities built by earlier tasks.The schema-config rule below is the named instance: if .specs/.sdd/schema-config.yaml exists, identify tasks that define schema contracts (endpoint definitions, model schemas, DDL changes) and confirm they are sequenced before any tasks that consume them. Surface any ordering gaps to the user before implementing (advisory — the user may decide the order is intentional).
Check tasks.md for already-completed tasks (- [x]). Start from the first unchecked task.
If all tasks are complete:
"All tasks are already complete. Runsdd-verifyto confirm the implementation, thensdd-syncandsdd-archive."
Stop.
For each unchecked task:
If not, implement them first
pytest with no --ignore / --deselect / -m filters).Inner-loop iteration may use a narrower scope, but the verification you act on — and any pass/fail count you report — must come from a broad-scope run. If you exclude any path, marker, or file, name the exclusion and justify it in the same message. "Not part of this change" is not a valid justification for a class or module rewrite — every test that imports the rewritten symbol is part of the change by definition. If a test fails, stop and resolve the failure before proceeding to the next step.
tasks.md: - [ ] → - [x]Follow design decisions in design.md — don't diverge without reason. Follow behavioral requirements in delta specs — these define what "correct" means. Apply the Critical Constraints above to every artifact you produce — code, comments, and commit messages alike.
If .specs/.sdd/schema-config.yaml exists and a task consumes a schema contract that is not yet defined, pause before implementing it. Surface the dependency gap and confirm with the user whether to reorder tasks in tasks.md first.
Each requirement's Serves: backlink (and the stories in proposal.md § User Stories) names the user value the work exists to deliver. That value is the scope ceiling: implement to the depth the served story requires, and no further.
When implementing surfaces behavior that no story motivates — extra configuration knobs, speculative generality, defensive paths beyond the contract, broader abstraction than the requirement needs — stop and surface it rather than building it silently. It is likely over-engineering, the failure mode this ceiling exists to bound. The user decides whether the extra work is justified (and, if so, which story it serves); the default is to leave it unbuilt.
A requirement you are implementing that carries no Serves: backlink is itself a flag — confirm it advances a real story before building to it.
A SHALL requirement may end up with multiple code paths that produce or modify the contract-asserted value during implementation — not just the canonical path. Common examples: deduplication shortcuts, cache fast-paths, retry/fallback branches, idempotency early-returns, merge or composition steps that write the same fields.
When implementing a task introduces such a path for an existing SHALL:
tasks.md that exercises the contract _through the new path_.The new test task must produce runnable evidence (test, schema check, or captured output) — same standard as the original SHALL coverage rule.
A test exercising only the canonical path does not stand in for evidence on a shortcut, retry, or composition path. This rule is what sdd-verify's write-site enumeration is checking; cover it at apply time and verify has nothing to flag.
When unsure whether a path is contract-relevant, surface it to the user rather than skipping the test task silently.
Before checking off the final task (hard gate):
rg/grep for tests that import any symbol you changed and confirm they ran in step 1.The blast-radius check is what catches tests pinned to rewritten classes or modules that a marker filter would silently skip.
Pass/fail counts without an exclusion list are not a verification report.
When the gate passes and all tasks are checked off:
"All tasks complete. Recommended next steps:
>
1. Runsdd-verifyto confirm implementation matches the change artifacts 2. Runsdd-syncto merge delta specs into main specs 3. Runsdd-archiveto complete the change"
This skill can be invoked at any point after tasks.md exists — not only when all artifacts are complete.
design.md or delta specs before continuing.proposal.md and tasks.md.D12) — in code, comments, commit messages, or PR descriptions (see Critical Constraints)commit-message when it is available, or without applying the Critical Constraints when it is notreferences/sdd-schema.md — schema config format (§ 3) and lifecycle policy (§ 4)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.