spec-kitty-research — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kitty-research (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Source: This skill augments the baseline workflow located at ./workflows/spec-kitty.research.md. It acts as an intelligent wrapper that is continuously improved with each execution.<!-- spec-kitty-command-version: 3.0.3 --> Path reference rule: When you mention directories or files, provide either the absolute path or a path relative to the project root (for example, kitty-specs/<feature>/tasks/). Never refer to a folder by name alone.
In repos with multiple features, always pass `--feature <slug>` to every spec-kitty command.
BEFORE PROCEEDING: Verify you are working in the project root checkout.
pwd
git branch --show-currentExpected output:
pwd: Should end with your project root directory path001-feature-name (NOT main)If you see the main branch or the wrong directory path:
⛔ STOP - You are in the wrong location!
This command creates research artifacts in your feature directory. You must be in the project root checkout.
Correct the issue:
cd /path/to/project/rootgit branch --show-currentWhen you run spec-kitty research, the following files are generated in your feature directory:
Generated files:
Location: All files go in kitty-specs/<feature-slug>/
Before this: /spec-kitty.plan calls this as "Phase 0" research phase
This command:
After this:
/spec-kitty.plan which uses your research to drive technical designCreate research.md, data-model.md, and supporting CSV stubs based on the active mission so implementation planning can reference concrete decisions and evidence.
spec-kitty research to generate the mission-specific research artifacts. (Add --force only when it is acceptable to overwrite existing drafts.)research.md – capture decisions, rationale, and supporting evidence.data-model.md – document entities, attributes, and relationships discovered during research.research/evidence-log.csv & research/source-register.csv – log all sources and findings so downstream reviewers can audit the trail.research/ and reference them inside research.md.research.md. These should feed directly into /spec-kitty.tasks and future implementation prompts.kitty-specs/<feature>/research.md explains every major decision with references to evidence.kitty-specs/<feature>/data-model.md lists the entities and relationships needed for implementation.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.