speckit-implement — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-implement (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Check for extension hooks (before implementation):
specs/extensions.yml exists in the project root.hooks.before_implement keyenabled: truecondition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementationoptional flag:optional: true): ## Extension Hooks
**Optional Pre-Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Pre-Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}
Wait for the result of the hook command before proceeding to the Outline.specs/extensions.yml does not exist, skip silentlyscripts/check-prerequisites.sh --json --require-tasks --include-tasks from repo root and parse FEATURE_DIR and AVAILABLE_DOCS list. All paths must be absolute. For single quotes in args like "I'm Groot", use escape syntax: e.g 'I'\''m Groot' (or double-quote if possible: "I'm Groot").- [ ] or - [X] or - [x]- [X] or - [x]- [ ] | Checklist | Total | Completed | Incomplete | Status |
|-----------|-------|-----------|------------|--------|
| ux.md | 12 | 12 | 0 | ✓ PASS |
| test.md | 8 | 5 | 3 | ✗ FAIL |
| security.md | 6 | 6 | 0 | ✓ PASS |Detection & Creation Logic:
git rev-parse --git-dir 2>/dev/nullignores entries cover required patternsIf ignore file already exists: Verify it contains essential patterns, append missing critical patterns only If ignore file missing: Create with full pattern set for detected technology
Common Patterns by Technology (from plan.md tech stack):
node_modules/, dist/, build/, *.log, .env*__pycache__/, *.pyc, .venv/, venv/, dist/, *.egg-info/target/, *.class, *.jar, .gradle/, build/bin/, obj/, *.user, *.suo, packages/*.exe, *.test, vendor/, *.out.bundle/, log/, tmp/, *.gem, vendor/bundle/vendor/, *.log, *.cache, *.envtarget/, debug/, release/, *.rs.bk, *.rlib, *.prof*, .idea/, *.log, .env*build/, out/, .gradle/, .idea/, *.class, *.jar, *.iml, *.log, .env*build/, bin/, obj/, out/, *.o, *.so, *.a, *.exe, *.dll, .idea/, *.log, .env*build/, bin/, obj/, out/, *.o, *.a, *.so, *.exe, *.dll, autom4te.cache/, config.status, config.log, .idea/, *.log, .env*.build/, DerivedData/, *.swiftpm/, Packages/.Rproj.user/, .Rhistory, .RData, .Ruserdata, *.Rproj, packrat/, renv/.DS_Store, Thumbs.db, *.tmp, *.swp, .vscode/, .idea/Tool-Specific Patterns:
node_modules/, .git/, Dockerfile*, .dockerignore, *.log*, .env*, coverage/node_modules/, dist/, build/, coverage/, *.min.jsnode_modules/, dist/, build/, coverage/, package-lock.json, yarn.lock, pnpm-lock.yaml.terraform/, *.tfstate*, *.tfvars, .terraform.lock.hcl*.secret.yaml, secrets/, .kube/, kubeconfig*, *.key, *.crtNote: This command assumes a complete task breakdown exists in tasks.md. If tasks are incomplete or missing, suggest running /speckit.tasks first to regenerate the task list.
specs/extensions.yml exists in the project root.hooks.after_implement keyenabled: truecondition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementationoptional flag:optional: true): ## Extension Hooks
**Optional Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}specs/extensions.yml does not exist, skip silently~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.