spec-kitty-sync-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kitty-sync-plugin (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external dependencies.
[!TIP] See INSTALL.md for instructions on how to install missing dependencies.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
You are an active administrator for the Spec-Driven Development framework. This skill handles both initial setup and ongoing updates, ensuring the CLI, templates, plugin, and agent environments are all in sync.
Key principle: This project maintains two layers of knowledge:
The sync must NEVER overwrite custom augmented knowledge. Instead, the agent reviews upstream changes and intelligently reconciles them with existing custom content.
references/diagrams/sync-plugin-flow.mmdreferences/diagrams/init-install-flow.mmdCRITICAL RULE: Do not simulate these steps. You must invoke the bash commands and read their outputs.
Check if .kittify/ exists in the project root:
test -d .kittify && echo "UPDATE" || echo "INIT"spec-kitty init . (no --force).spec-kitty init . --force.Install or update the spec-kitty-cli package:
pip install --upgrade spec-kitty-cliConfirm the installed version:
spec-kitty --versionPull the latest command templates, mission configs, and scripts into .kittify/:
INIT mode (first time):
spec-kitty init . --ai windsurfThis creates `.kittify/`, `.windsurf/workflows/`, mission configs, and git hooks.
UPDATE mode (existing project):
spec-kitty init . --ai windsurf --forceThis refreshes existing templates without affecting project-specific configs.
Convert the refreshed .kittify/ templates into distributable plugin components inside the spec-kitty-plugin directory:
python ./scripts/sync_configuration.pyThis generates skills, rules, and templates that agents can consume.
IMPORTANT: This step ONLY touches auto-generated files (14 command skill SKILL.md files, rules, templates). It does NOT touch custom skills listed below.
This is the intelligence step. After the automated sync, you MUST review what changed and reconcile with custom augmented skills.
#### 3b.1: Identify What Changed
Compare the new .kittify/ content against what was there before:
git diff --stat -- .kittify/ .windsurf/ ../../Summarize the key changes for the user (new commands, removed commands, changed templates, updated mission configs).
#### 3b.2: Review Custom Skills
The following contain custom augmented knowledge that is NOT generated by sync_configuration.py. They MUST be reviewed for staleness after every upstream update:
Custom Skills (in skills/, never touched by sync):
| Custom Skill | Contains | Review For |
|---|---|---|
skills/spec-kitty-workflow/SKILL.md | End-to-end workflow guide, safety steps, best practices | New commands/phases added upstream, safety guidance still accurate |
skills/spec-kitty-sync-plugin/SKILL.md | This skill (meta) | Script paths still valid, new sync features |
skills/spec-kitty-agent/SKILL.md | Agent config sync, combined lifecycle | New agent configs, changes to sync scripts |
AUGMENTED.md Files (in skills/*/references/, adjacent to auto-synced SKILL.md — never overwritten):
| Augmented File | Contains | Review For |
|---|---|---|
references/AUGMENTED.md | Pre-merge safety protocol, branch protection awareness, kitty-specs conflict resolution | New merge flags, changed CLI behavior |
references/AUGMENTED.md | Worktree discipline, commit hygiene, dependency management | New implement flags, changed validation rules |
references/AUGMENTED.md | Batch review protocol, review standards, dependency verification | New review commands, changed lane logic |
For each custom skill:
.kittify/ command templates#### 3b.3: Propose Updates (Never Overwrite)
If changes are needed in custom skills:
Present proposed changes to the user in diff format before applying them.
#### 3b.4: Protected Files Checklist & Escalation Taxonomy
Before completing the sync, verify these files were NOT deleted or corrupted:
./rules/constitution.md./references/standard-workflow-rules.mdtest -f ./rules/constitution.md && echo "constitution OK" || echo "MISSING!"Escalation Taxonomy (Missing Data Response) If ANY protected file is missing or ls returns an error, trigger the Escalation Taxonomy:
🚨 PROTECTED FILE MISSING 🚨git checkout -- <file>.ASK THE USER before deploying:
Which plugins should I install/update? 1. Only spec-kitty-plugin (just the updated spec-kitty commands) 2. All plugins (full ecosystem sync across all 80+ plugins)
After performing the sync, you must deploy the updated plugin to your agent environment.
[!IMPORTANT] Zero Inline Commands: See the central installation guide for the authoritative deployment logic: ### 👉 INSTALL.md
This handles both forced re-installation and full ecosystem synchronization across all 80+ plugins.
Inform the user:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.