specflow-use-9f533f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited specflow-use-9f533f (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill helps you drive Grid Dynamics SpecFlow from a local workspace via SpecFlow MCP. Rosetta stays local; SpecFlow runs everything remotely. The skill loads project context from gain.json and guides the user through SpecFlow MCP tool usage.
SpecFlow MCP is the only user interface to SpecFlow: you order work and download outputs. You do not connect to or operate on the remote workspaces directly.
When the user mentions SpecFlow or works in a SpecFlow-enabled project:
gain.json at the workspace root (and up to 2 parents). If missing, SpecFlow MCP will create it on the first tool call (together with specflow_session.json).references/specflow-mcp-tools.md.Check for gain.json at the current workspace root. If not found, check parent directories up to 2 levels. If still missing, tell the user this workspace is not yet initialized for SpecFlow — the first SpecFlow MCP tool call will create both gain.json and specflow_session.json.
When gain.json is found, present a compact summary:
## SpecFlow Project Context
**Description**: [gain.json.description]
**Services**: specflow — [gain.json.servicesDescription.specflow]
rosetta — [gain.json.servicesDescription.rosetta]
**Supported Coding Agents**: [gain.json.codingAgents]
**Versions**:
- rosetta: [gain.json.versions.rosetta]
- specflow: [gain.json.versions.specflow]
**Vocabulary overrides** (if present in gain.json.vocabulary):
- (See references/specflow-vocabulary.md for defaults.)Compare gain.json.versions.rosetta with the current Rosetta version:
Read references/specflow-mcp-tools.md to route the user to the correct phase (pregeneration, generation, or post-run).
When SpecFlow returns a review report and the user wants to fix their specs before another iteration, delegate to Rosetta core:
skills/requirements-authoringworkflows/requirements-authoring-flow.mdThat skill handles iterative requirement updates with explicit user approval — matching the "consolidate the review report into updated specs" loop.
Read as needed:
references/specflow-mcp-tools.md — Phase routing and post-run skill bootstrap.references/specflow-vocabulary.md — Status values and checkpoint gates users encounter in responses.references/specflow-schema.md — Session files, version channels, and status enum quick lookup.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.