spec-writer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-writer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when you need to:
*.spec.md file from a feature request, bug report, or product idea.Produce a single *.spec.md file that is clear, bounded, verifiable, and directly usable by coding agents.
The spec must behave like an execution contract:
Write the spec around observable behavior and constraints first. Add implementation notes only when they are necessary to avoid wrong architectural choices.
Each requirement must describe one behavior only. Do not combine multiple independent behaviors into a single requirement.
Use stable IDs and write requirements in a way that can be verified:
REQ-<DOMAIN>-<NNN>: The system must or must not <behavior> when <condition> so that <user or business outcome>.
Good example:
REQ-AUTH-001: The system must reject a login attempt after 5 consecutive failures from the same IP within 15 minutes and return HTTP 429.
Bad example:
REQ-AUTH-001: The login should feel secure and robust.
Use Given / When / Then for main flows and edge cases.
Example:
/admin/usersEvery spec must include three guardrail groups:
Always allowedAsk beforeNever doThis reduces unsafe or out-of-scope implementation by coding agents.
Every spec must say what is in scope and what is out of scope. If this is missing, agents will infer and overreach.
The spec must say how completion will be validated:
If a missing detail changes behavior, data model, public contracts, or scope, pause and ask. If the missing detail is editorial and a safe default exists, proceed and document the assumption in Open Questions / Assumptions.
Collect as much as possible from the user request and repository context:
If the request is too vague, ask only for the missing information that changes the resulting behavior.
If code already exists, inspect the current implementation in read mode first and infer:
Do not invent architecture that conflicts with the repository.
Always create the output as <feature-name>.spec.md.
Use the exact section order below unless the user explicitly asks for a different format.
*.spec.md Structure# <Feature or Change Title>
## Metadata
- Spec ID: SPEC-<DOMAIN>-<NNN>
- Status: draft | approved | implemented
- Owner: <team or person>
- Last Updated: YYYY-MM-DD
- Related Paths: <files, directories, routes, services>
## Objective
<One short paragraph describing the business or user outcome>
## Context
<Relevant background, current behavior, or repository facts>
## In Scope
- <explicit inclusion>
## Out of Scope
- <explicit exclusion>
## Actors
- <actor>: <role in the flow>
## Functional Requirements
### REQ-<DOMAIN>-001
<Verifiable requirement statement>
Acceptance Criteria
- Given <state>
- When <action>
- Then <observable result>
### REQ-<DOMAIN>-002
<Next requirement>
Acceptance Criteria
- Given <state>
- When <action>
- Then <observable result>
## Non-Functional Requirements
- NFR-<DOMAIN>-001: <performance, security, availability, observability, accessibility, etc.>
## Constraints and Dependencies
- <technical constraint>
- <external dependency>
## Guardrails
### Always Allowed
- <safe changes an agent may make>
### Ask Before
- <changes that require user confirmation>
### Never Do
- <forbidden changes>
## Relevant Components
- <path>: <why it matters>
## Verification Plan
- <tests to add or update>
- <manual validation steps>
- <commands or checks>
## Definition of Done
- <condition that must be true at completion>
## Open Questions / Assumptions
- <question or explicit assumption>Before finalizing a spec, verify that it answers these questions:
If one of these is missing, the spec is not ready.
When the user asks for a spec and does not specify a filename:
<feature-name>.spec.mdassets/spec-template.md: reusable writing template for *.spec.mdreferences/writing-principles.md: condensed rules derived from the repository's SDD writing guideExample 1:
Input: Create a spec for bulk user import with CSV validation and duplicate detection.
Output:
bulk-user-import.spec.mdExample 2:
Input: Turn the current device enrollment flow into a proper spec using the existing code.
Output:
# Locate existing specs
rg --files -g "*.spec.md"
# Locate feature-related code before writing a spec from existing behavior
rg -n "<feature-keyword>" src~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.