spec-implement — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-implement (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execute the approved Spec-backed Plan. Track progress when it uses tracked tasks. Report. Stop when blocked.
Announce at start: "I'm using the spec-implement skill to execute this plan."
This skill does not make design decisions or change approved content. It may persist approved content from the conversation when Plan Mode could not write the required artifact. If the plan is wrong, go back to spec-plan. If the design is wrong, go back to spec-brainstorm.
Resolve required artifacts in order before starting product implementation:
docs/specs/YYYY-MM-DD-<feature>/design.md is missing, write it from the approved designin the current conversation. Validate the file, report its path, and stop. Do not create plan.json or start implementation in the same invocation.
docs/specs/YYYY-MM-DD-<feature>/plan.json is missing, write it from theapproved plan in the current conversation. Validate it against the schema in spec-plan, report its path, and stop. Do not start implementation in the same invocation.
conversation, stop and tell the human what content is unavailable. Do not ask the human to create the file.
available, along with docs/agents/issue-tracker.md when tracking is configured.
a git worktree first.
Each invocation creates at most one missing artifact. Only proceed to product implementation when both approved artifacts existed at the start of the invocation.
Read plan.json critically before writing code. Look for:
If planned machinery fails these checks, stop before implementing it and return to spec-plan with a smaller revision for human review. Preserve the approved behavior and scope; do not force an unsupported structure through implementation.
For other concerns, raise them with the human before starting. Don't guess. Don't assume. Don't force through blockers.
If no concerns, proceed. Use existing tracker entries when present.
If the human has not specified an execution style, ask.
"Implement it all. Don't stop until you're done."
"Do a few tasks at a time."
In any mode, delegate a task to a fresh subagent when the design is already settled and the file just needs to be made, as defined by the code-subagents "When to Use" criteria.
atelier-orchestrator)validation commands itself
"Use subagents."
Delegate every eligible task. Independent tasks dispatch in parallel, dependent tasks run sequentially.
Default to batched if the human hasn't expressed a preference; delegation still applies per task.
Preserve the approved behavior and scope. Treat the plan's proposed structure as a hypothesis that must remain supported by repository evidence.
For each task, find the next unblocked task directly from plan.json. When tracker entries exist, use docs/agents/issue-tracker.md to keep their execution state in sync; tracker state never overrides the plan's dependency graph.
When a tracker exists, mark it in progress according to docs/agents/issue-tracker.md.
Read the task's inputs and description first.
For behavior-changing code tasks, write tests that cover the validation criteria before writing implementation. For documentation, configuration, migration, or verification-only tasks, use the task's stated validation instead. Invoke an installed language-specific testing skill when needed. Write tests at the module's interface (see oracle-codebase-design), and use its red flags when refactoring.
1. Read task inputs and description
2. Write failing tests (cover validation criteria)
3. Run them — verify they fail for the RIGHT reason
4. Implement minimal code to make tests pass
5. Refactor if needed (tests stay green)For behavior-changing code, do NOT write implementation before tests. Do NOT skip "verify it fails." Do NOT write more code than needed to pass the test.
Verify the task against its validation and acceptance criteria.
Run the task's focused validation and inspect the local diff for accidental or out-of-scope changes. Report deviations and unexpected findings. Use code-commit for any commit; plan approval does not bypass its approval gate. Comprehensive code-review happens in spec-finish.
When a tracker exists, mark the task complete according to docs/agents/issue-tracker.md.
When the plan or human references existing implementations ("make it look like the users table"), read the referenced code before making changes. A reference communicates all implicit requirements without spelling them out.
After each batch:
Completed: [tasks]
- [completed work]
Test output: 6 passed, 0 failed
Type check: clean
Ready for feedback.Wait. Don't continue until the human responds.
Expect short, terse corrections:
deduplicateByTitle."Don't ask for elaboration unless genuinely needed.
| Pattern | Example | What to do |
|---|---|---|
| Cherry-pick | "Use X for the first one. Ignore the fourth." | Item-level as directed |
| Trim scope | "Skip task T7." | Mark skipped, move on |
| Protect interfaces | "These signatures must not change." | Adapt callers |
| Override | "Use the library's built-in method." | Direct override |
| Revert | "I reverted. Now just do X." | Respect narrowed scope |
If the human reverts git changes and re-scopes, respect the narrowed scope completely. Don't salvage the previous approach. Don't ask "are you sure?"
STOP immediately when:
When you stop:
Do not guess. Do not work around it. Stop and ask. Ask for clarification rather than guessing.
If the plan needs to change:
"This needs a plan revision. Want me to go back to spec-plan?"
If the design was wrong:
"This changes design assumptions. Want me to go back to spec-brainstorm?"
Return to spec-plan when:
Minor deviations may be recorded inline and reflected in plan.json when useful. Report them in the next progress update.
Return to spec-brainstorm when:
When all planned work is done, verify and present it.
Present to the human:
## Feature Complete: {feature name}
**Plan:** Spec-backed Plan
**Tasks:** {completed} / {total}
**Tests:** {new tests added}, {total passing}
**Files:** {created}, {modified}
### What was built
- [concise list of what was implemented]
### Verification
- Test suite: ✓ all passing
- Type check: ✓ clean
- Lint: ✓ clean
- Comprehensive code review: pending spec-finish
### Ready for reviewAfter all planned work is complete and verified, the next step is spec-finish.
"Implementation complete. Ready to validate, review, and prepare for PR?"
Offer the human their options:
Finish — invoke spec-finish to validate, review, stack commits Keep — leave the branch for now, come back later Discard — delete the branch, start over
Don't choose for them. Present options and wait.
If validation finds bugs, loop back to implement. See atelier-orchestrator for iteration patterns.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.