spec-kit-skill-d8eb37 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kit-skill-d8eb37 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Official GitHub Spec-Kit integration providing a 7-phase constitution-driven workflow for feature development.
This skill works with the GitHub Spec-Kit CLI to guide you through structured feature development:
Storage: Creates files in .specify/specs/NNN-feature-name/ directory with numbered features
First, verify if spec-kit CLI is installed:
command -v specify || echo "Not installed"If not installed:
# Persistent installation (recommended)
uv tool install specify-cli --from git+https://github.com/github/spec-kit.git
# One-time usage
uvx --from git+https://github.com/github/spec-kit.git specify init <PROJECT_NAME>Requirements:
If CLI is installed but project not initialized:
# Initialize in current directory
specify init . --ai claude
# Initialize new project
specify init <project-name> --ai claude
# Options:
# --force: Overwrite non-empty directories
# --script ps: Generate PowerShell scripts (Windows)
# --no-git: Skip Git initialization<details> <summary>🔍 Phase Detection Logic</summary>
Before proceeding, always detect the current state:
if command -v specify &> /dev/null || [ -x "$HOME/.local/bin/specify" ]; then
echo "CLI installed"
else
echo "CLI not installed - guide user through installation"
fiif [ -d ".specify" ] && [ -f ".specify/memory/constitution.md" ]; then
echo "Project initialized"
else
echo "Project not initialized - guide user through 'specify init'"
fi# Get latest feature directory
LATEST=$(ls -d .specify/specs/[0-9]* 2>/dev/null | sort -V | tail -1)
echo "Latest feature: $LATEST"Detect phase by checking file existence in latest feature:
FEATURE_DIR=".specify/specs/001-feature-name"
if [ ! -f ".specify/memory/constitution.md" ]; then
echo "Phase: constitution"
elif [ ! -d "$FEATURE_DIR" ]; then
echo "Phase: specify"
elif [ -f "$FEATURE_DIR/spec.md" ] && ! grep -q "## Clarifications" "$FEATURE_DIR/spec.md"; then
echo "Phase: clarify"
elif [ ! -f "$FEATURE_DIR/plan.md" ]; then
echo "Phase: plan"
elif [ ! -f "$FEATURE_DIR/tasks.md" ]; then
echo "Phase: tasks"
elif [ -f "$FEATURE_DIR/tasks.md" ] && grep -q "\\- \\[ \\]" "$FEATURE_DIR/tasks.md"; then
echo "Phase: implement"
else
echo "Phase: complete"
fi</details>
<details> <summary>📜 Phase 1: Constitution</summary>
Establish foundational principles that govern all development decisions.
Create .specify/memory/constitution.md with:
# Project Constitution
## Core Values
1. **[Value Name]**: [Description and implications]
2. **[Value Name]**: [Description and implications]
## Technical Principles
### Architecture
- [Principle with rationale]
### Code Quality
- [Standards and expectations]
### Performance
- [Performance criteria]
## Decision Framework
When making technical decisions, consider:
1. [Criterion with priority]
2. [Criterion with priority]# Project Constitution
## Core Values
1. **Simplicity Over Cleverness**: Favor straightforward solutions that are easy to understand and maintain over clever optimizations.
2. **User Experience First**: Every technical decision should improve or maintain user experience.
## Technical Principles
### Architecture
- Prefer composition over inheritance
- Keep components loosely coupled
- Design for testability
### Code Quality
- Code reviews required for all changes
- Unit test coverage > 80%
- Documentation for public APIs
### Performance
- Page load < 3 seconds
- API response < 200ms
- Progressive enhancement for slower connections
## Decision Framework
When choosing between approaches:
1. Does it align with our core values?
2. Is it maintainable by the team?
3. Does it scale with our growth?
4. What's the long-term cost?</details>
<details> <summary>📝 Phase 2: Specify</summary>
Define what needs building and why, avoiding technology specifics.
# Create new feature
.specify/scripts/bash/create-new-feature.sh --json "feature-name"
# Expected JSON output:
# {"BRANCH_NAME": "001-feature-name", "SPEC_FILE": "/path/to/.specify/specs/001-feature-name/spec.md"}Parse JSON: Extract BRANCH_NAME and SPEC_FILE for subsequent operations.
Load .specify/templates/spec-template.md to understand required sections, then create specification at SPEC_FILE location.
Focus on functional requirements:
# Feature Specification: [Feature Name]
## Problem Statement
[What problem are we solving?]
## User Stories
### Story 1: [Title]
As a [role]
I want [capability]
So that [benefit]
**Acceptance Criteria:**
- [ ] [Specific, testable criterion]
- [ ] [Specific, testable criterion]
### Story 2: [Title]
[Continue...]
## Non-Functional Requirements
- Performance: [Specific metrics]
- Security: [Requirements]
- Accessibility: [Standards]
- Scalability: [Expectations]
## Success Metrics
- [Measurable outcome]
- [Measurable outcome]
## Out of Scope
[Explicitly state what's NOT included]The script automatically:
001-feature-name)</details>
<details> <summary>❓ Phase 3: Clarify</summary>
Resolve underspecified areas through targeted questioning.
Before planning implementation, ensure specification is complete and unambiguous.
## Clarifications
### Q1: [Clear, specific question]
**Context**: [Why this matters]
**Options**: [If multiple approaches exist]
### Q2: [Clear, specific question]
**Context**: [Why this matters]
**Impact**: [What decisions depend on this]## Clarifications
### Q1: How should the system handle conflicts when two users edit the same document simultaneously?
**Context**: This affects data model design and user experience.
**Options**:
- Last-write-wins (simple, may lose data)
- Operational transforms (complex, preserves all edits)
- Locked editing (simple, limits collaboration)
**Answer**: [User provides answer]
### Q2: What's the maximum number of concurrent users we need to support?
**Context**: Affects infrastructure planning and architecture decisions.
**Impact**: Determines caching strategy, database choices, and scaling approach.
**Answer**: [User provides answer]</details>
<details> <summary>🏗️ Phase 4: Plan</summary>
Create technical implementation strategy based on clarified specification.
# Setup plan phase
.specify/scripts/bash/setup-plan.sh --json
# Expected JSON output:
# {"FEATURE_SPEC": "/path/spec.md", "IMPL_PLAN": "/path/plan.md", "SPECS_DIR": "/path/specs", "BRANCH": "001-feature"}#### 1. Main Plan (plan.md)
# Implementation Plan: [Feature Name]
## Technology Stack
### Frontend
- Framework: [Choice with rationale]
- State Management: [Choice with rationale]
- Styling: [Choice with rationale]
### Backend
- Language/Framework: [Choice with rationale]
- Database: [Choice with rationale]
- API Style: [REST/GraphQL/etc with rationale]
## Architecture
### System Overview
graph TD A[Client] --> B[API Gateway] B --> C[Service Layer] C --> D[Data Layer]
### Component Design
#### Component 1: [Name]
- **Responsibility**: [What it does]
- **Interfaces**: [APIs it exposes]
- **Dependencies**: [What it needs]
[Continue for all components...]
## Design Patterns
- [Pattern]: [Where and why used]
## Security Considerations
- Authentication: [Approach]
- Authorization: [Approach]
- Data Protection: [Approach]
## Performance Strategy
- Caching: [Strategy]
- Optimization: [Key areas]
## Error Handling
- Error types and handling strategies
- Logging and monitoring approach#### 2. Data Model (data-model.md)
# Data Model
## Entity Relationship
erDiagram USER ||--o{ DOCUMENT : creates USER { string id string email string role } DOCUMENT { string id string title string content }
## Schemas
### Userinterface User { id: string; email: string; role: 'admin' | 'editor' | 'viewer'; createdAt: Date; }
[Continue for all entities...]#### 3. API Contracts (contracts/)
Create API specifications:
api-spec.json (OpenAPI/Swagger)signalr-spec.md (if using SignalR)#### 4. Research (research.md) - Optional
Document technology investigations:
# Research: [Topic]
## Options Evaluated
### Option 1: [Technology]
**Pros**: [Benefits]
**Cons**: [Drawbacks]
**Fit**: [How well it matches our needs]
### Option 2: [Technology]
[Same structure...]
## Recommendation
[Chosen option with rationale]
## References
- [Source 1]
- [Source 2]#### 5. Quick start (quickstart.md) - Optional
Setup instructions for developers.
Before finalizing:
</details>
<details> <summary>✅ Phase 5: Tasks</summary>
Generate dependency-ordered, actionable implementation tasks.
# Check prerequisites
.specify/scripts/bash/check-prerequisites.sh --json [--require-tasks] [--include-tasks]
# Output: {"FEATURE_DIR": "/path", "AVAILABLE_DOCS": ["spec.md", "plan.md", ...]}Create .specify/specs/NNN-feature/tasks.md:
# Implementation Tasks: [Feature Name]
## Phase 1: Foundation
- [ ] 1.1 Set up project structure
- Create directory layout per architecture doc
- Configure build tools
- Initialize testing framework
- **Depends on**: None
- **Requirement**: R1.1
- [ ] 1.2 [P] Configure development environment
- Set up linters and formatters
- Configure CI/CD pipeline basics
- **Depends on**: 1.1
- **Requirement**: R1.2
## Phase 2: Core Implementation
- [ ] 2.1 Implement User model and persistence
- Create User entity with validation
- Implement repository pattern
- Write unit tests
- **Depends on**: 1.1
- **Requirement**: R2.1, R2.3
- [ ] 2.2 [P] Implement Document model
- Create Document entity
- Define relationships with User
- Write unit tests
- **Depends on**: 1.1
- **Requirement**: R2.2
- [ ] 2.3 Implement API endpoints
- Create REST controllers
- Add request/response validation
- Write integration tests
- **Depends on**: 2.1, 2.2
- **Requirement**: R3.1, R3.2
[Continue with all phases...]
## Phase N: Integration & Testing
- [ ] N.1 End-to-end testing
- Write E2E test scenarios
- Test critical user paths
- **Depends on**: [all previous]
- **Requirement**: All
## Notes
- `[P]` indicates tasks that can be parallelized
- Always check dependencies before starting
- Reference requirements for acceptance criteriaEach task should:
Task Types:
Exclude:
</details>
<details> <summary>🔍 Phase 6: Analyze</summary>
Cross-artifact consistency and quality validation (read-only).
Before implementation, verify:
# Extract requirements
grep -E "R[0-9]+\.[0-9]+" spec.md | sort -u > requirements.txt
# Extract referenced requirements in tasks
grep -E "Requirement.*R[0-9]+" tasks.md | sort -u > covered.txt
# Compare
comm -23 requirements.txt covered.txtConstitution Alignment:
Requirement Coverage:
Technical Coherence:
Task Dependencies:
# Analysis Report
## ✅ Passing Checks
- All requirements covered
- Constitution alignment verified
- No circular dependencies
## ⚠️ Warnings
- Requirement R3.4 has no corresponding task
- Task 5.2 references undefined dependency
## 🔴 Critical Issues
None found
## Recommendations
1. Add task for Requirement R3.4
2. Clarify dependency for task 5.2
3. Consider breaking task 6.1 into smaller tasks (estimated 8 hours)</details>
<details> <summary>⚙️ Phase 7: Implement</summary>
Execute tasks systematically, respecting dependencies and test-driven development.
# For each task:
# 1. Read context
cat .specify/specs/001-feature/spec.md
cat .specify/specs/001-feature/plan.md
cat .specify/specs/001-feature/data-model.md
# 2. Check dependencies
# Verify all depends-on tasks are complete
# 3. Implement
# Write code per task description
# 4. Test
# Write and run tests
# 5. Validate
# Check against requirements
# 6. Mark complete
# Update tasks.md: - [x] task completedFor each task:
Before marking task complete:
If implementation reveals issues:
Update tasks.md as you go:
- [x] 1.1 Set up project structure ✓ Complete
- [x] 1.2 [P] Configure development environment ✓ Complete
- [ ] 2.1 Implement User model ← Currently here
- [ ] 2.2 [P] Implement Document modelFeature is complete when:
</details>
.specify/
├── memory/
│ └── constitution.md # Phase 1
├── specs/
│ └── 001-feature-name/ # Numbered features
│ ├── spec.md # Phase 2
│ ├── plan.md # Phase 4
│ ├── data-model.md # Phase 4
│ ├── contracts/ # Phase 4
│ │ ├── api-spec.json
│ │ └── signalr-spec.md
│ ├── research.md # Phase 4 (optional)
│ ├── quickstart.md # Phase 4 (optional)
│ └── tasks.md # Phase 5
├── scripts/
│ └── bash/
│ ├── check-prerequisites.sh
│ ├── create-new-feature.sh
│ ├── setup-plan.sh
│ └── common.sh
└── templates/
├── spec-template.md
├── plan-template.md
└── tasks-template.mdSpec-Kit provides a rigorous, constitution-based approach to feature development with clear phases, explicit dependencies, and comprehensive documentation at every step. The workflow ensures alignment from principles through implementation.
For advanced detection logic and automation scripts, see:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.