spec-driven-development — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-driven-development (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Agree on what and how before writing a single line of code.
Inspired by GitHub spec-kit and AWS Kiro: capture intent in three living documents, gate each on approval, and let the spec — not memory — be the source of truth the agent codes against.
| Write a spec | Skip it |
|---|---|
| New feature or capability | One-line / typo fix |
| Touches 3+ files or modules | Single obvious change |
| Requirements are fuzzy or contested | Behavior is fully clear |
| Cross-cutting (auth, data model, API) | Local refactor with tests already green |
| You'd struggle to write a test for it | You can already name the assertion |
Rule of thumb: if you can't state the acceptance test in one sentence, you need a spec.
Each is one file. Keep them short and current; stale specs are worse than none.
(As a <role>, I want <capability>, so that <benefit>), and numbered requirements R1, R2… Each requirement carries EARS acceptance criteria (see the ears-acceptance-criteria skill). No solution detail here.
trade-offs / alternatives considered. Reference requirements by id (R1, R2) so coverage is traceable. Name the risks and open questions.
the design. Mark independent items [P] (parallel). Every task should map back to a requirement and be independently verifiable.
requirements.md ──approve──▶ design.md ──approve──▶ tasks.md ──approve──▶ CODE
WHAT HOW STEPS implementbefore requirements are agreed; no code before design is approved.
tasks.md,and if it changes intent, bump design.md / requirements.md and re-confirm.
# 1. Scaffold the three artifacts + an umbrella task linked via --spec
aim spec new "user profile export"
# → .ai-context/docs/specs/user-profile-export/{requirements,design,tasks}.md
# → umbrella task-N (spec = @doc/.../requirements.md)requirements.md (EARS) → design.md → tasks.md, getting approval ateach gate.
tasks.md into tracked tasks two ways:dependency-ordered list and creates tasks via create_tasks.
aim task create "<title>" --depends-on <id> --ac "<criterion>",using --depends-on to encode the order from tasks.md.
aim spec coverage (how many tasks have a linked spec)and aim task next (next actionable task with deps satisfied).
aim spec import <dir>.aim spec new "dark mode toggle"requirements.md (excerpt)
### R1: Toggle theme
As a user, I want a theme toggle, so that I can read comfortably at night.
Acceptance criteria (EARS):
1. WHEN the user clicks the theme toggle THE SYSTEM SHALL switch between light
and dark within 100ms.
2. THE SYSTEM SHALL persist the selected theme across sessions.
3. WHILE no preference is stored THE SYSTEM SHALL follow the OS color scheme.design.md (excerpt) — ThemeProvider holds state; persisted to localStorage; default reads prefers-color-scheme. Trade-off: CSS variables over a class-per-component approach (one repaint, smaller diff).
tasks.md → tracked tasks
aim task create "Add ThemeProvider + context" --ac "exposes theme + toggle()"
aim task create "Wire toggle button to context" --depends-on 41
aim task create "Persist + hydrate from localStorage" --depends-on 41
aim task create "Default to prefers-color-scheme" --depends-on 43Only after design.md is approved do you start task 41. Mark [x] in tasks.md and update task status as you go.
| ❌ Don't | ✅ Do |
|---|---|
| Jump straight to code | Pass the requirements → design gate first |
Put implementation in requirements.md | Keep WHAT/WHY pure; HOW lives in design |
| Write a 5-page spec for a small change | Match spec depth to risk; skip when trivial |
| Let the spec rot after coding | Flow discoveries back left and re-confirm |
| One giant task | Decompose into ordered, verifiable tasks |
The spec is the contract between intent and implementation. Approve left to right; code last.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.