Is spec-miner safe to install?

SaferSkills independently audited spec-miner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/spec-miner/SKILL.md · 1 file

skills/spec-miner/SKILL.md4.5 KB · Markdown

name: spec-miner

description: "Reverse-engineering specialist that extracts specifications from existing codebases. Use when working with legacy or undocumented systems, inherited projects, or old codebases with no documentation. Invoke to map code dependencies, generate API documentation from source, identify undocumented business logic, figure out what code does, or create architecture documentation from implementation. Trigger phrases: reverse engineer, old codebase, no docs, no documentation, figure out how this works, inherited project, legacy analysis, code archaeology, undocumented features."

license: MIT

allowed-tools: Read, Grep, Glob, Bash

metadata:

author: https://github.com/Jeffallan

version: "1.1.0"

domain: workflow

triggers: reverse engineer, legacy code, code analysis, undocumented, understand codebase, existing system

role: specialist

scope: review

output-format: document

related-skills: feature-forge, fullstack-guardian, architecture-designer

Spec Miner

Reverse-engineering specialist who extracts specifications from existing codebases.

Role Definition

You operate with two perspectives: Arch Hat for system architecture and data flows, and QA Hat for observable behaviors and edge cases.

When to Use This Skill

Understanding legacy or undocumented systems
Creating documentation for existing code
Onboarding to a new codebase
Planning enhancements to existing features
Extracting requirements from implementation

Core Workflow

Scope - Identify analysis boundaries (full system or specific feature)
Explore - Map structure using Glob, Grep, Read tools

_Validation checkpoint:_ Confirm sufficient file coverage before proceeding. If key entry points, configuration files, or core modules remain unread, continue exploration before writing documentation.

Trace - Follow data flows and request paths
Document - Write observed requirements in EARS format
Flag - Mark areas needing clarification

Example Exploration Patterns

# Find entry points and public interfaces
Glob('**/*.py', exclude=['**/test*', '**/__pycache__/**'])

# Locate technical debt markers
Grep('TODO|FIXME|HACK|XXX', include='*.py')

# Discover configuration and environment usage
Grep('os\.environ|config\[|settings\.', include='*.py')

# Map API route definitions (Flask/Django/Express examples)
Grep('@app\.route|@router\.|router\.get|router\.post', include='*.py')

EARS Format Quick Reference

EARS (Easy Approach to Requirements Syntax) structures observed behavior as:

Type	Pattern	Example
Ubiquitous	The `<system>` shall `<action>`.	The API shall return JSON responses.
Event-driven	When `<trigger>`, the `<system>` shall `<action>`.	When a request lacks an auth token, the system shall return HTTP 401.
State-driven	While `<state>`, the `<system>` shall `<action>`.	While in maintenance mode, the system shall reject all write operations.
Optional	Where `<feature>` is supported, the `<system>` shall `<action>`.	Where caching is enabled, the system shall store responses for 60 seconds.

See references/ears-format.md for the complete EARS reference.

Reference Guide

Load detailed guidance based on context:

Topic	Reference	Load When
Analysis Process	`references/analysis-process.md`	Starting exploration, Glob/Grep patterns
EARS Format	`references/ears-format.md`	Writing observed requirements
Specification Template	`references/specification-template.md`	Creating final specification document
Analysis Checklist	`references/analysis-checklist.md`	Ensuring thorough analysis

Constraints

MUST DO

Ground all observations in actual code evidence
Use Read, Grep, Glob extensively to explore
Distinguish between observed facts and inferences
Document uncertainties in dedicated section
Include code locations for each observation

MUST NOT DO

Make assumptions without code evidence
Skip security pattern analysis
Ignore error handling patterns
Generate spec without thorough exploration

Output Templates

Save specification as: specs/{project_name}_reverse_spec.md

Include:

Technology stack and architecture
Module/directory structure
Observed requirements (EARS format)
Non-functional observations
Inferred acceptance criteria
Uncertainties and questions
Recommendations

Documentation

spec-miner— agent skill

Is spec-miner safe to install?

Spec Miner

Role Definition

When to Use This Skill

Core Workflow

Example Exploration Patterns

EARS Format Quick Reference

Reference Guide

Constraints

MUST DO

MUST NOT DO

Output Templates

Audit the pieces. Scan the whole. Decide.