requirements-use-e19143 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited requirements-use-e19143 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<requirements-use>
<role>
You are expert in using requirements as execution contract.
</role>
<when_to_use_skill> Triggers: implementing from approved requirements; planning work from requirement IDs; auditing requirement-to-delivery traceability. Rules: every in-scope change traces to requirement IDs; unresolved ambiguity escalates via HITL; no unapproved scope. </when_to_use_skill>
<dependencies>
questioning.</dependencies>
<core_concepts>
Role and boundaries:
Default output sections:
Artifacts:
HITL gates (use when):
</core_concepts>
<process>
</process>
<core_principles_to_enforce>
</core_principles_to_enforce>
<requirement_usage_rules>
</requirement_usage_rules>
<traceability_rules>
</traceability_rules>
<ambiguity_and_conflict_rules>
</ambiguity_and_conflict_rules>
<validation_checklist>
</validation_checklist>
<best_practices>
</best_practices>
<pitfalls>
</pitfalls>
<resources>
assets/ru-traceability-matrix.mdassets/ru-change-log.md</resources>
<requirement_unit_template>
Every single-value field is an attribute; only prose and structured children are nodes. Read implementation and implementationNotes from the attributes and node respectively; write them back in place when status changes.
<req id="FR-[AREA]-####" type="FR|NFR|INT|DATA" level="System|Subsystem|Component"
subsystem="[name; required when level is Subsystem or Component; otherwise fill when known]"
component="[name; required when level is Component; otherwise fill when known]"
ticketId="[tracker key]" classification="business|technical"
source="User|Inferred|Sources|Documentation"
priority="Must|Should|Could|Wont" verification="Test|Analysis|Inspection|Demo"
status="Draft|Approved|Deprecated|Removed" approved_by="[login or user name of the approver]" changed="[YYYY-MM-DD]"
depends="[comma-separated IDs]"
implementation="NotStarted|Implemented|Planned|ToBeModified|ToBeRemoved">
<title>[the single outcome this unit governs; noun phrase, unique within the area]</title>
<statement>[the governing rule: what shall hold, over which cases, with its limits and explicit exclusions. NOT an EARS sentence, NOT a restatement of the criteria]</statement>
<rationale>[why this shape and not another: basis for each threshold, actor and boundary; alternatives rejected and why rejected]</rationale>
<evidence>[reverse-engineering only: source-code path + the named symbol + artifact at it (function, class, const, type) per location. Source code ONLY - never a plan, discovery, TEMP or other working artifact. Line ranges drift on every edit, names do not]</evidence>
<acceptance>
<criteria id="[req-id].AC1" ears="ubiquitous" system="[whatever responds: actor or specific system/subsystem/component/etc]" shall="[outcome]"/>
<criteria id="[req-id].AC2" ears="event" when="[trigger]" system="[responder]" shall="[outcome]"/>
<criteria id="[req-id].AC3" ears="state" while="[state]" system="[responder]" shall="[outcome]"/>
<criteria id="[req-id].AC4" ears="optional" where="[feature is present]" system="[responder]" shall="[outcome]"/>
<criteria id="[req-id].AC5" ears="unwanted" if="[fault]" system="[responder]" shall="[mitigation]"/>
</acceptance>
<implementationNotes>[CONCISE: Implemented: aggregated files affected, NotStarted/Planned/ToBeRemoved: nothing, ToBeModified: what was originally documented but now dropped]</implementationNotes>
<notes>[anything else; the rejection reason when status is Removed]</notes>
</req>Coverage queries this shape enables: implementation="NotStarted" for unbuilt scope, implementation="ToBeModified" for spec-vs-code drift, status="Draft" for anything not yet approved to build against.
</requirement_unit_template>
</requirements-use>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.