speq-record — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speq-record (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Thin orchestrator. It verifies preconditions and delegates the merge work to the recorder-agent sub-agent.
Invoke before starting:
/speq-cli — Spec validationThe recorder-agent sub-agent invokes its own required skills.
Check for .speq/record-hook.md in the repo root.
Note it (not its full content) as a Project Hook: line in the recorder-agent brief below.
Get the plan name from the user prompt. If none is given, ask the user to choose from the plans under specs/_plans/.
Check: specs/_plans/<plan-name>/verification-report.md exists?
├─ Yes → Proceed
└─ No → STOP: "Run /speq-implement <plan-name> first."Spawn the recorder sub-agent with the plan name:
Delegate to recorder-agent — Record <plan-name> into permanent specs
## Plan Name
<plan-name>
## Context
- Verification report confirmed at: specs/_plans/<plan-name>/verification-report.md
- Plan file: specs/_plans/<plan-name>/plan.md
- Delta specs: specs/_plans/<plan-name>/**/spec.md
- Architecture delta (optional): specs/_plans/<plan-name>/architecture.md
## Your Task
Merge all delta specs, and the architecture delta if present, into permanent specs per the `recorder-agent` workflow. Validate between merges. Archive the plan on success. If any library threshold is exceeded (scenarios > 10, domain features > 8), STOP before archiving and return a question for the user.
Project Hook: <if active, ".speq/record-hook.md — read it and apply it"; otherwise omit this line>
Return a summary of merged features and the archive path.If the sub-agent returns threshold signals:
recorder-agent with the decision, OR apply a trivial edit (for example, a file rename) directlyIf the sub-agent returns Recording failed: architecture delta: ..., do not respawn it and do not fix the delta yourself. The plan stays unarchived. Report the message to the user and stop. The fix is a plan change: correct architecture.md in the plan, or refresh its BASE after a stale-base error.
Report to user:
✓ Verification report confirmed
✓ All deltas merged
✓ Spec library validated
✓ Plan archived: specs/_recorded/NNN-<plan-name>
✓ Architecture merged: <sections> (omit when no delta)
✓ ADRs accepted: N — <slugs> (omit when none)| Step | Performed by | Why |
|---|---|---|
| Precondition checks, user questions | This skill (pins Sonnet) | Lightweight orchestration |
| Delta merge, validation, archive | recorder-agent sub-agent | Fixed steps: apply markers, validate, archive |
The split preserves rotation discipline: the orchestrator can respawn the sub-agent with a fresh context and keep its own state.
| Pattern | Why Wrong |
|---|---|
| Record without verification report | Implementation not proven |
| Archive after an architecture delta failure | The delta was not merged, so the plan must stay open |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.