speckit-specify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-specify (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The user's message that triggered this skill is the feature description. Do not ask the user to repeat it unless they provided no description.
Given that feature description, do this:
--short-name (and --json), and do NOT pass --number (the script auto-detects the next globally available number across all branches and spec directories):scripts/create-new-feature.sh "<feature-description>" --json --short-name "user-auth" "Add user authentication"scripts/create-new-feature.sh "<feature-description>" -Json -ShortName "user-auth" "Add user authentication"IMPORTANT:
--number — the script determines the correct next number automatically--json for Bash, -Json for PowerShell) so the output can be parsed reliablyreferences/spec-template.md to understand required sections.If empty: ERROR "No feature description provided"
Identify: actors, actions, data, constraints
If no clear user flow: ERROR "Cannot determine user scenarios"
Each requirement must be testable Use reasonable defaults for unspecified details (document assumptions in Assumptions section)
Create measurable, technology-agnostic outcomes Include both quantitative metrics (time, performance, volume) and qualitative measures (user satisfaction, task completion) Each criterion must be verifiable without implementation details
a. Create Spec Quality Checklist: Generate a checklist file at FEATURE_DIR/checklists/requirements.md using the checklist template structure with these validation items:
# Specification Quality Checklist: [FEATURE NAME]
**Purpose**: Validate specification completeness and quality before proceeding to planning
**Created**: [DATE]
**Feature**: [Link to spec.md]
## Content Quality
- [ ] No implementation details (languages, frameworks, APIs)
- [ ] Focused on user value and business needs
- [ ] Written for non-technical stakeholders
- [ ] All mandatory sections completed
## Requirement Completeness
- [ ] No [NEEDS CLARIFICATION] markers remain
- [ ] Requirements are testable and unambiguous
- [ ] Success criteria are measurable
- [ ] Success criteria are technology-agnostic (no implementation details)
- [ ] All acceptance scenarios are defined
- [ ] Edge cases are identified
- [ ] Scope is clearly bounded
- [ ] Dependencies and assumptions identified
## Feature Readiness
- [ ] All functional requirements have clear acceptance criteria
- [ ] User scenarios cover primary flows
- [ ] Feature meets measurable outcomes defined in Success Criteria
- [ ] No implementation details leak into specification
## Notes
- Items marked incomplete require spec updates before `/speckit.clarify` or `/speckit.plan`b. Run Validation Check: Review the spec against each checklist item:
c. Handle Validation Results:
## Question [N]: [Topic]
**Context**: [Quote relevant spec section]
**What we need to know**: [Specific question from NEEDS CLARIFICATION marker]
**Suggested Answers**:
| Option | Answer | Implications |
|--------|--------|--------------|
| A | [First suggested answer] | [What this means for the feature] |
| B | [Second suggested answer] | [What this means for the feature] |
| C | [Third suggested answer] | [What this means for the feature] |
| Custom | Provide your own answer | [Explain how to provide custom input] |
**Your choice**: _[Wait for user response]_| Content | not |Content||--------|d. Update Checklist: After each validation iteration, update the checklist file with current pass/fail status
/speckit.clarify or /speckit.plan).NOTE: The script creates and checks out the new branch and initializes the spec file before writing.
When creating this spec from a user prompt:
Examples of reasonable defaults (don't ask about these):
Success criteria must be:
Good examples:
Bad examples (implementation-focused):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.