spec 100/100 — SaferSkills

Is spec safe to install?

SaferSkills independently audited spec (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/spec/SKILL.md · 1 file

skills/spec/SKILL.md2.2 KB · Markdown

name: spec

description: "Define requirements before planning. Use when starting a new feature, when requirements are ambiguous, or when the user says 'write a spec' or 'define requirements'."

Write a specification for: $ARGUMENTS

Follow this workflow:

Discovery: ask the user clarifying questions before writing anything. Cover:

Who - who is the user/audience for this feature?
What - what exactly should it do? What is the expected behavior?
Why - what problem does it solve? What is the success metric?
Constraints - what technical, time, or scope constraints exist?
Boundaries - what is explicitly out of scope?
Ask one question at a time, waiting for the answer before asking the next. The list above is the topic checklist to cover across the discovery phase, not a batch to dump in one turn. See rules/communication.md.

Draft the spec: based on the answers, write a specification with these sections:

# Spec: <title>

## Problem Statement
<What problem does this solve and for whom?>

## User Stories
- As a <role>, I want <capability> so that <benefit>

## Acceptance Criteria
- [ ] <Specific, testable criterion>
- [ ] <Specific, testable criterion>

## Non-Functional Requirements
- Performance: <latency, throughput targets>
- Security: <auth, data handling requirements>
- Accessibility: <WCAG level, specific requirements>

## Technical Constraints
- <Stack, infrastructure, API compatibility requirements>

## Out of Scope
- <Explicitly excluded from this work>

## Open Questions
**why-not-mechanizable:** skill workflow guidance; each step requires understanding the surrounding context (repo, task shape, prior state).

- <Anything unresolved that needs a decision>

Save: save the spec to .claude/state/specs/YYYY-MM-DD-spec-<topic>.md (review-time: see section note)
Review: present the spec to the user. Wait for approval before proceeding to /plan. (review-time: see section note)
Iterate: if the user has feedback, update the spec and re-present. Repeat until approved. (review-time: see section note)

Do NOT proceed to planning or implementation until the spec is explicitly approved.

spec— agent skill

Is spec safe to install?

Audit the pieces. Scan the whole. Decide.