spec-finish — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-finish (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Post-implementation workflow: simplify → synchronize docs → validate → review → prepare PR.
Before starting, verify:
If not complete, go back to spec-implement.
Compare the implementation with the original behavior and user goal before documentation or validation. Remove unrequested scope, duplicate concepts, one-consumer abstractions, and custom machinery that replaces sufficient platform behavior.
If the implementation faithfully follows an unnecessarily large design, stop and return to spec-plan. Get approval for the smaller plan before continuing.
Update the finished SDD to describe the smaller result. Replace rejected architecture in the normative design and plan instead of preserving it as precedent; mention it only as a rejected alternative when that history remains useful.
Check whether README, API documentation, or changelog updates are needed. Make and commit any necessary documentation changes through code-commit before final validation.
Run validation checks.
npm test
# or
pytest
# or
cargo testnpm run typecheck
# or
python -m mypy
# or
cargo checknpm run lint
# or
ruff check .
# or
cargo clippynpm run build
# or
go build ./...If any fail: Return to spec-implement to fix.
If all pass: Proceed.
Invoke the installed code-review skill through the harness's skill mechanism for one comprehensive review of the final change.
blocking: true or requires_user_approval, and scope-changing fixes, return tospec-implement. Non-blocking findings and follow-ups do not.
Review current commits with git log --oneline. Use code-commit for any uncommitted work. Do not rewrite history by default. If a rebase would materially improve an unpublished stack, show the affected range and ask for separate approval before rebasing.
Steps 1-5 (simplification, documentation, validation, review, commits) must all be complete before proceeding. If code-review found blocking findings or ones requiring user approval, stop and return to spec-implement to fix them. Do not proceed to Step 6b.
Before creating the PR, present a summary to the human:
## Completion Summary
**Feature:** [name]
**Tests:** [passed/failed]
**Type Check:** [passed/failed]
**Lint:** [passed/failed]
**Review:** [passed/issues found]
**Commits:** [N commits in stack]
**Ready for PR:** [yes/no]Only when the summary shows Ready for PR: yes, invoke the code-pull-request skill to create the PR. It detects the platform (GitHub/GitLab), checks for an existing PR, finds a template, generates the body from commits, and opens the PR via gh or glab.
"Implementation complete. [N] commits are ready. PR package ready for approval."
This skill orchestrates other skills:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.