sdd-translate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd-translate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Convert existing specifications from other frameworks, tools, or formats into SDD spec files.
SPECS_ROOTis resolved by thesddrouter before this skill runs. Replace.specs/with your project's actual specs root in all paths below.
sdd-translate.sdd-derive insteadsdd-verify to check completenessBaseline specs (.specs/specs/) document implemented behavior. Translated specs should only go to baseline when the codebase already implements the described behavior.
digraph output_type {
"Codebase implements\nthe described behavior?" [shape=diamond];
"Translate to baseline specs\n(.specs/specs/)" [shape=box];
"Translate to change directory\n(.specs/changes/<name>/)\nADDED-only delta specs" [shape=box];
"Codebase implements\nthe described behavior?" -> "Translate to baseline specs\n(.specs/specs/)" [label="yes — documenting what exists"];
"Codebase implements\nthe described behavior?" -> "Translate to change directory\n(.specs/changes/<name>/)\nADDED-only delta specs" [label="no — greenfield or aspirational"];
}How to check: After inventorying source specs (Phase 1), survey the codebase for relevant implementation. If the capabilities described in the source specs have no corresponding code, the translated specs are aspirational — generate a change directory with ADDED-only delta specs, a proposal.md, and optionally a tasks.md. If the codebase already implements the described behavior, translate directly to baseline.
spec.md + plan.md with Markdown headings.specs/specs/<capability>/spec.md:auth/, payments/, notifications/api/, frontend/, workers/ordering/, fulfillment/Before generating specs, count requirements across all source material:
| Signal | Action |
|---|---|
| ≤ 8 requirements total | Single capability, proceed directly |
| 9–20 requirements | Split into 2–4 capabilities, proceed |
| 20+ requirements | Present capability split to user, wait for confirmation |
When decomposing, present the proposed split:
Proposed capabilities:
- auth/ → login, session, token management (5 reqs)
- payments/ → billing, subscriptions (6 reqs)
- ui/ → themes, layout (4 reqs)
Proceed with this split? (or suggest changes)When the output type is a change directory (greenfield or aspirational — see Determine Output Type above), present capabilities in build-dependency order rather than alphabetically; the implementer will work through them in the order shown. See references/sdd-change-formats.md § 4. For baseline output (code already exists), ordering is a presentation choice — alphabetical is fine.
Output path depends on the output type decision above:
.specs/specs/<capability>/spec.md following SDD baseline format..specs/changes/<name>/ with:proposal.md — intent, user stories, scope, approach (see references/sdd-change-formats.md § 1.1)specs/<capability>/spec.md — ADDED-only delta specs, each requirement carrying a Serves: backlink to a proposal storytasks.md — when implementation steps are clear (optional)Also seed .specs/NORTH-STAR.md if absent — draft a candidate product north star from the source specs for the user to ratify; each user story ladders to it. When the source uses user-story grammar ("As a … I want … so that …"), the story belongs in proposal.md § User Stories (keep the "so that {value}" clause); translate only the WHAT into the requirement and point its Serves: line back at the story.
Preserve the Phase 2 build-dependency order in proposal.md Scope and tasks.md when present. If implementation steps are unclear and tasks.md is omitted, mention any ordering assumptions in the output summary.
See references/sdd-spec-formats.md for both baseline and delta spec formats.
Add a source attribution blockquote at the top of each generated spec (see format reference Section 2):
Translated from {source tool/format} on {date} Source: {source file or description}
Read `references/sdd-spec-formats.md` § 1 before translating. The translation is from the source doc's grammar into SDD contract statements (see § 1.1 contract shapes). Source docs from other tools (Spec Kit, Jira, ADRs, prose) commonly mix WHAT and HOW in the same sentence; translate only the contract, and route mechanism detail to design.md or discard it.
When the translated requirement is a universal SHALL, apply the partition heuristic in references/sdd-spec-formats.md § 1.6 to the source's acceptance criteria. Source docs frequently capture only the happy-path acceptance criterion; if the heuristic flags a partition the source did not cover, surface the gap as an Uncertainty rather than fabricating scenarios.
Translation rules:
| Source pattern | SDD translation |
|---|---|
| "Users can X" | The system SHALL allow users to X |
| Acceptance criteria bullets | #### Scenario: entries with GIVEN/WHEN/THEN (as evidence of the requirement — see § 1.5) |
| "It should Y" | The system SHOULD Y |
| "Required: Z" | The system MUST Z |
| Implementation detail (class names, libraries) | Move to ## Technical Notes (baseline) or design.md (change directory); omit from the requirement |
| Named algorithm / threshold / strategy (e.g., "use TF-IDF bottom quartile", "retry 3 times") | Translate to the property it produces (e.g., "queries that produce no relevant documents"); route the named strategy to design.md |
| Phase-gated steps (plan.md, tasks.md) | Omit — not behavior |
| "As a user, I want X so that Y" | Baseline: The system SHALL allow users to X (value layer dropped — baseline is value-free). Change directory: capture the story incl. "so that Y" in proposal.md § User Stories and add a Serves: backlink on the requirement |
| "Shall not / Must not" | The system SHALL NOT / MUST NOT {prohibited behavior} |
Numbered requirement IDs (e.g., REQ-001:) | Strip the ID prefix; preserve the requirement text |
Critical rules:
references/sdd-spec-formats.md § 1.1 (guarantee, invariant, prohibition, precondition-consequence, observable-state relationship)#### (4 hashtags), requirements use ### (3 hashtags)## Purpose or ## Technical Notes## User Stories in proposal.md (keep each "so that {value}" clause) and add a Serves: backlink to each delta requirement; seed .specs/NORTH-STAR.md if absent.Baseline output is value-free — no stories or backlinks.
Common to both output types:
### Requirement: uses RFC 2119 keywords (SHALL/MUST/SHOULD/MAY)references/sdd-spec-formats.md § 1.1 — a property about observable state that stands on its own without its scenariosreferences/sdd-spec-formats.md § 1.6 — when a positive signal fires, scenarios cover each partition (or the gap is recorded as an Uncertainty)#### heading level (not ### or #####)## Technical Notes (baseline) or design.md (change directory), not left in the requirement textBaseline output only:
## Purpose section present in each specChange directory output only:
proposal.md exists with Intent, User Stories, Scope, ApproachNORTH-STAR.mdServes: backlink to a proposal storyproposal.md Scope and tasks.md preserve build-dependency order when the translation produced implementer-facing change artifacts## Purpose or ## Technical Notes in delta specsIf .specs/.sdd/schema-config.yaml exists:
.specs/schemas/ — this establishes the baseline for all future sdd-verify conformance checks..specs/schemas/.schema-sources.yaml with the generation date.If no schema config exists but schema artifacts are detected in the repo (e.g., openapi.yaml, .proto files, schema.graphql), suggest creating .specs/.sdd/schema-config.yaml before the first sdd-verify run:
"Detected schema artifacts. A.specs/.sdd/schema-config.yamlwould letsdd-verifycross-validate implementation against these specs. Seereferences/sdd-schema.md§ 3 for the format. Say 'skip' to dismiss."
If no schema config and no artifacts detected, skip silently.
Baseline (code exists):
.specs/specs/<capability>/spec.md per capabilityChange directory (greenfield/aspirational):
.specs/changes/<name>/proposal.md.specs/changes/<name>/specs/<capability>/spec.md (ADDED-only delta format).specs/changes/<name>/tasks.md (when applicable)Summary: capabilities created, requirement count per capability, translation notes and assumptions.
/users then insert into users table" is mechanism in both the source and a literal translation.Translate to the property the source was trying to guarantee ("a user account is created") and route the mechanism to design.md. See references/sdd-spec-formats.md § 1.
.specs/specs/ asserts implemented behavior; if nothing is built yet, use a change directory with ADDED-only delta specsServes: backlink; only baseline output (which is value-free) drops the value layerreferences/sdd-spec-formats.md — baseline spec and scenario formatsreferences/sdd-schema.md — schema config format and lifecycle policy~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.