spec-approach — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-approach (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Take an existing feature spec and add the ## Approach — the HOW that tdd needs to execute. Same file, append only.
diagnose — already contain Root cause and Fix).If invoked in a skip case, recognise it and tell the user "this looks trivial / already approached — go straight to tdd". Do not write anything.
Identify the spec. A path or slug for an existing spec/<slug>.md must be given. If neither was provided, ask the user which spec — do not guess. Never operate without an explicit target.
Validate it. Read the file. It must contain Goal, Behaviors, and Acceptance criteria. If any are missing, abort and tell the user to run interview-to-spec first. Never try to fill in WHAT.
## Approach to the same spec file.Write. Anchor on the last existing line or section of the spec; the new content is the anchor + \n\n## Approach\n....## Approach section## Approach
- **Strategy.** One paragraph describing how the work will be done end-to-end.
- **Modules / files.** Concrete paths to create or modify.
- **Key decisions.** The alternative considered and why this one. One bullet per decision.
- **Schema / API changes.** If any. Otherwise omit this bullet.
- **Risks.** Anything that might surprise us during execution. If none, omit this bullet.Keep each bullet tight. The reader is tdd — it needs enough to execute, not a design doc.
## Approach already existsDo not overwrite silently. Read the existing approach, then ask the user: "There's already an approach here. Want me to revise it, or is it still good?" Only edit if they confirm. When revising, replace the existing ## Approach block via Edit — do not append a second one.
The spec is now self-sufficient. tdd consumes it directly — Behaviors + Acceptance criteria become the test queue; Approach guides the implementation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.