sdd — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Claude Code plugin marketplace. `pilot-spec` drives spec-driven dev, `pilot-plan` drafts the GitHub paperwork, `pilot-core` ships shared skills.
Code consistency is the casualty of LLM agent velocity.
Modern LLMs write code faster than any human can read it — and faster than the agent can stay coherent with itself. Vibe coding outruns spec-driven dev by the third feature that contradicts the first two. Multi-agent orchestration makes it worse: sub-agents race on shared files, tooling glues the diffs together, and the _reasoning_ ends up scattered across transcripts nobody reads.
pilot-spec fixes this with one source of truth. Single-thread Claude. One `SPEC.md`. Math-glyph compression. §V invariants are what the agent re-reads every turn, so task ten is built against the same constraints as task one. The human reviews the spec, not every diff.
Token prices will rise. When they do, raw token volume drives the bill — and math-glyph compression stops being a stylistic choice.
You can't measure ROI without a target. Code rewrites itself; diffs ship and disappear. §V invariants don't move — they're what the code is measured against. That's the target.
Consistency is what compounds. Every other artifact — diffs, transcripts, the code itself — gets superseded. §V outlives the framework swap. §B outlives the bug. At 30%–85% of prose-baseline tokens, they outlive the price hike too.
SPEC.md holds invariants, tasks, and bugs together. Multi-file systems (e.g. GitHub Spec Kit) fan out across spec/, plan/, tasks/. Past a certain size, no agent run sees all of it, and the spec stops being a shared reference./sdd:check. You get a read-only drift report: which §V invariants the code violates, which §T tasks remain. No digging through old transcripts./sdd:check is only useful if the spec is current. backprop fires on every test or build failure — records a §B bug row, usually adds a §V invariant. So the drift report stays trustworthy.pilot-spec — Spec-Driven Development (SDD)/sdd:explore # optional pre-design — pass 1 layer enum + bail-out + pass 2 layer x frame divergence → matrix @ designs/<slug>-explore.md
/sdd:design # propose-then-critique structural design → draft @ designs/<slug>.md
/sdd:spec # write or amend the spec — invariants (§V), tasks (§T), bugs (§B)
/sdd:build # plan-then-execute next task; auto-backprops on test/build failure
/sdd:check # read-only drift report — code vs §V / §I / §T (memo-driven fast re-runs by default; --full forces full re-classify)
/sdd:explain # decompress any §X.n citation back into plain English
/sdd:compact # operator-fired SPEC.md compaction sweep — folds, archives, trims to fit token budget
/sdd:reorganize # operator-fired §V cluster + renumber + cite-DAG sweep — clarity-shape passSPEC.md. No docs/ tree, no JSON sidecars./sdd:spec is the only command that mutates the spec. (/sdd:build may flip a task status cell . → x; nothing else writes.)§V / §T / §B rows are ~30% denser than minimal prose and ~85% denser than the prose a reviewer actually reads. The compression comes from terse grammar and compact §-refs, not math symbols — heavy operators measured 2–4 tokens each and were retired to ASCII words. Bench, methodology, and worked examples in benchmarks/glyph/README.md.§B row, usually a §V invariant. The spec doesn't forget. ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐
│/sdd:design │──►│ /sdd:spec │──►│ /sdd:build │──►│ /sdd:check │
│ propose │ │ mutator │ │ plan→exec │ │ read-only │
└────────────┘ └─────▲──────┘ └─────┬──────┘ └─────┬──────┘
│ │ │
│ ▼ on failure │ on drift
│ ┌────────────┐ │
│ │ backprop │ │
│ │ §B (+ §V) │ │
│ └─────┬──────┘ │
│ │ │
└────────────────┴────────────────┘
amend SPEC.mdFull manual → pilot-spec/README.md.
pilot-plan — GitHub workflow/gh:issue, /gh:pr, /gh:commit, /gh:merge, /gh:release. Drafts the text around the code — issue descriptions, PR bodies, commit messages, release notes — in steno-style shorthand. The human edit is minutes, not paragraphs. Workflow only — no code development.
Full manual → pilot-plan/README.md.
pilot-core — shared skillsFoundation plugin. Ships socratic (intent-gate) and steno (human-facing shorthand) for cross-plugin reuse via namespaced refs (core:socratic, core:steno). Both pilot-spec and pilot-plan declare it as a dependency; Claude Code auto-installs.
Add the marketplace (one-time):
/plugin marketplace add kborovik/pilot-skillsInstall `pilot-spec` (spec-driven dev — pilot-core auto-installs):
/plugin install sdd@pilot-skillsInstall `pilot-plan` (GitHub workflow — pilot-core auto-installs):
/plugin install gh@pilot-skillsThe sdd plugin (directory pilot-spec/) is adapted from JuliusBrussee/cavekit, MIT-licensed. See pilot-spec/README.md for full attribution.
MIT. See LICENSE. Upstream cavekit attribution: pilot-spec/README.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.