speckit-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-plan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
$ARGUMENTSYou MUST consider the user input before proceeding (if not empty).
Check for extension hooks (before planning):
.specify/extensions.yml exists in the project root.hooks.before_plan key.specify/extensions.yml could not be read (include the parser error) and that no hooks were checked, including any mandatory (optional: false) hooks registered there, then continue normallyenabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: true): ## Extension Hooks
**Optional Pre-Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Pre-Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}
Wait for the result of the hook command before proceeding to the Outline.After emitting the block above you MUST actually invoke the hook and wait for it to finish before continuing. Run it the same way you would run the command yourself in this agent/session (the invocation may differ from the literal {command} id shown above, e.g. a skills-mode agent runs it as /skill:speckit-... or $speckit-...). Emitting the block alone does not run the hook.
.specify/extensions.yml does not exist, skip silently.specify/scripts/bash/setup-plan.sh --json from repo root and parse JSON for FEATURE_SPEC, IMPL_PLAN, FEATURE_DIR, BRANCH. For single quotes in args like "I'm Groot", use escape syntax: e.g 'I'\''m Groot' (or double-quote if possible: "I'm Groot")..specify/memory/constitution.md. Load IMPL_PLAN template (already copied).You MUST complete this section before reporting completion to the user.
Check if .specify/extensions.yml exists in the project root.
hooks.after_plan, skip to the Completion Report.hooks.after_plan key..specify/extensions.yml could not be read (include the parser error) and that no hooks were checked, including any mandatory (optional: false) hooks registered there, then continue to the Completion Report.enabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: false) — You MUST emit `EXECUTE_COMMAND:` for each mandatory hook: ## Extension Hooks
**Automatic Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}After emitting the block above you MUST actually invoke the hook and wait for it to finish before continuing. Run it the same way you would run the command yourself in this agent/session (the invocation may differ from the literal {command} id shown above, e.g. a skills-mode agent runs it as /skill:speckit-... or $speckit-...). Emitting the block alone does not run the hook.
optional: true): ## Extension Hooks
**Optional Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`Command ends after Phase 1 design. Report branch, IMPL_PLAN path, and generated artifacts.
For each unknown in Technical Context:
Task: "Research {unknown} for {feature context}"
For each technology choice:
Task: "Find best practices for {tech} in {domain}"research.md using format:Output: research.md with all NEEDS CLARIFICATION resolved
Prerequisites: research.md complete
data-model.md:/contracts/:quickstart.md:tasks.md and the implementation phaseOutput: data-model.md, /contracts/*, quickstart.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.