spec-driven-development — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-driven-development (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write a structured specification before writing any code. The spec is the shared source of truth between you and the engineer who asked for the work: it fixes what is being built, why, and how completion will be judged. Code written without a spec is a guess.
Single-line fixes, typo corrections, or changes whose requirements are unambiguous and self-contained.
Four phases. Do not advance to the next phase until the current one is validated by the human.
SPECIFY ──→ PLAN ──→ TASKS ──→ IMPLEMENT
│ │ │ │
▼ ▼ ▼ ▼
Human Human Human Human
reviews reviews reviews reviewsStart from a high-level vision. Ask clarifying questions until the requirements are concrete.
Surface assumptions first. Before writing any spec content, list what you are assuming and force a correction:
ASSUMPTIONS I'M MAKING:
1. Runtime target is a long-running service (not a CLI or batch job)
2. Auth uses signed session cookies (not bearer tokens)
3. Persistence is a relational store, inferred from the existing schema
4. Only current language/runtime versions are supported (no legacy targets)
→ Correct me now or I proceed with these.Do not silently fill in ambiguous requirements. The spec exists to surface misunderstandings before code is written; an unstated assumption is the most dangerous form of misunderstanding.
Write a spec covering six core areas:
# Node / npm
Build: npm run build
Test: npm test -- --coverage
Lint: npm run lint --fix
Dev: npm run dev
# Rust / cargo
Build: cargo build --release
Test: cargo test
Lint: cargo clippy -- -D warnings
Run: cargo run # TypeScript service
src/ application source
src/lib/ shared utilities
tests/ unit + integration tests
e2e/ end-to-end tests
docs/ documentation
# Python package
src/pkg/ package source
tests/ unit + integration tests
docs/ documentation
pyproject.toml build + dependency configSpec template:
# Spec: [Project/Feature Name]
## Objective
[What is being built and why. User stories or acceptance criteria.]
## Tech Stack
[Framework, language, key dependencies with versions]
## Commands
[Build, test, lint, dev — full commands]
## Project Structure
[Directory layout with descriptions]
## Code Style
[Example snippet + key conventions]
## Testing Strategy
[Framework, test locations, coverage requirements, test levels]
## Boundaries
- Always: [...]
- Ask first: [...]
- Never: [...]
## Success Criteria
[How completion is judged — specific, testable conditions]
## Open Questions
[Anything unresolved that needs human input]Reframe instructions as success criteria. Translate vague requirements into measurable conditions, whatever the domain:
REQUIREMENT: "Make the dashboard faster"
REFRAMED:
- LCP < 2.5s on a 4G connection
- Initial data load completes in < 500ms
- No layout shift during load (CLS < 0.1)
REQUIREMENT: "The batch job is too slow"
REFRAMED:
- Processes 1M records in < 90s on the reference host
- Peak resident memory < 512 MB
- Exits non-zero on any partial failure
→ Are these the right targets?Concrete targets let you loop, retry, and solve toward a defined goal instead of guessing what "faster" means.
From the validated spec, produce a technical implementation plan:
The plan must be reviewable: the human reads it and either approves the approach or names the part to change.
Break the plan into discrete, implementable tasks:
Task template:
- [ ] Task: [Description]
- Acceptance: [What must be true when done]
- Verify: [How to confirm — test command, build, manual check]
- Files: [Which files will be touched]Execute tasks one at a time, test-first: turn each task's acceptance criteria into a failing test, then write the code that makes it pass. At each step, load only the spec sections and source files the current task needs; do not flood the working context with the entire spec. Verify each task against its acceptance criteria before starting the next.
The spec is a living document, not a one-time artifact:
| Rationalization | Reality |
|---|---|
| "This is simple, I don't need a spec" | Simple tasks don't need long specs, but they still need acceptance criteria. A two-line spec is fine. |
| "I'll write the spec after I code it" | That is documentation, not specification. The spec's value is forcing clarity before code. |
| "The spec will slow us down" | A 15-minute spec prevents hours of rework. Fifteen minutes of waterfall beats fifteen hours of debugging. |
| "Requirements will change anyway" | That is why the spec is a living document. An outdated spec still beats no spec. |
| "The user knows what they want" | Even clear requests carry implicit assumptions. The spec surfaces them. |
Before proceeding to implementation, confirm:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.