spec-kitty-analyze — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kitty-analyze (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Source: This skill augments the baseline workflow located at ./workflows/spec-kitty.analyze.md. It acts as an intelligent wrapper that is continuously improved with each execution.<!-- spec-kitty-command-version: 3.0.3 -->
$ARGUMENTSYou MUST consider the user input before proceeding (if not empty).
In repos with multiple features, always pass `--feature <slug>` to every spec-kitty command.
Identify inconsistencies, duplications, ambiguities, and underspecified items across the three core artifacts (spec.md, plan.md, tasks.md) before implementation. This command MUST run only after /tasks has successfully produced a complete tasks.md.
STRICTLY READ-ONLY: Do not modify any files. Output a structured analysis report. Offer an optional remediation plan (user must explicitly approve before any follow-up editing commands would be invoked manually).
Constitution Authority: The project constitution (/constitution/constitution.md) is non-negotiable within this analysis scope. Constitution conflicts are automatically CRITICAL and require adjustment of the spec, plan, or tasks—not dilution, reinterpretation, or silent ignoring of the principle. If a principle itself needs to change, that must occur in a separate, explicit constitution update outside /analyze.
Run spec-kitty agent feature check-prerequisites --json --include-tasks once from repo root and parse JSON for feature_dir, available_docs, target_branch, and base_branch. Derive absolute paths:
Abort with an error message if any required file is missing (instruct the user to run missing prerequisite command).
Load only the minimal necessary context from each artifact:
From spec.md:
From plan.md:
From tasks.md:
From constitution:
/constitution/constitution.md for principle validationCreate internal representations (do not include raw artifacts in output):
user-can-upload-file)Focus on high-signal findings. Limit to 50 findings total; aggregate remainder in overflow summary.
#### A. Duplication Detection
#### B. Ambiguity Detection
<placeholder>, etc.)#### C. Underspecification
#### D. Constitution Alignment
#### E. Coverage Gaps
#### F. Inconsistency
Use this heuristic to prioritize findings:
Output a Markdown report (no file writes) with the following structure:
| ID | Category | Severity | Location(s) | Summary | Recommendation |
|---|---|---|---|---|---|
| A1 | Duplication | HIGH | spec.md:L120-134 | Two similar requirements ... | Merge phrasing; keep clearer version |
(Add one row per finding; generate stable IDs prefixed by category initial.)
Coverage Summary Table:
| Requirement Key | Has Task? | Task IDs | Notes |
|---|
Constitution Alignment Issues: (if any)
Unmapped Tasks: (if any)
Metrics:
At end of report, output a concise Next Actions block:
/implementAsk the user: "Would you like me to suggest concrete remediation edits for the top N issues?" (Do NOT apply them automatically.)
$ARGUMENTS
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.