spec-kitty-tasks-outline — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kitty-tasks-outline (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Source: This skill augments the baseline workflow located at ./workflows/spec-kitty.tasks-outline.md. It acts as an intelligent wrapper that is continuously improved with each execution.<!-- spec-kitty-command-version: 3.0.3 -->
Version: 0.12.0+
Create tasks.md — the task breakdown document that defines work packages, subtask lists, dependency descriptions, and sizing estimates. This step produces the outline only; individual WP prompt files are generated in the next step.
You are creating the blueprint for implementation. The quality of work packages determines:
QUALITY OVER SPEED: Take your time to understand the full scope deeply, break work into clear pieces, and write detailed guidance.
IMPORTANT: This step works in the project root checkout. NO worktrees created.
Do NOT cd anywhere. Stay in the project root checkout root.
In repos with multiple features, always pass `--feature <slug>` to every spec-kitty command.
$ARGUMENTSYou MUST consider the user input before proceeding (if not empty).
Before proceeding, resolve canonical command context:
spec-kitty agent context resolve --action tasks_outline --jsonTreat that JSON as canonical for feature slug, feature directory, and target branch. Do not probe git branch state manually inside the prompt.
Run the exact check_prerequisites command returned by the resolver. Capture feature_dir plus available_docs. All paths must be absolute.
CRITICAL: The command returns JSON with feature_dir as an ABSOLUTE path. YOU MUST USE THIS PATH for ALL subsequent file operations.
Read from feature_dir (only those present):
Scale your effort to the feature: simple UI tweaks deserve lighter coverage, multi-system releases require deeper decomposition.
Create complete list of subtasks with IDs T001, T002, etc.:
[P] means safe to parallelize per file/concern).Group subtasks into work packages (IDs WP01, WP02, ...):
TARGET SIZE: 3-7 subtasks per WP (200-500 line prompts) MAXIMUM: 10 subtasks per WP (700 line prompts) If more than 10 subtasks needed: Create additional WPs, don't pack them in
GROUPING PRINCIPLES:
Requirement Refs line listing IDs from spec.md (FR/NFR/C)tasks.mdWrite to feature_dir/tasks.md following the tasks template structure below (do NOT write instructions to read a template file from `.kittify/`):
WPxx entriesRequirement Refs: FR-001, NFR-001, C-001)Txxx)Requirements Coverage Summary section mapping every requirement ID in spec.md to one or more WPsDO NOT generate WP prompt files in this step. That happens in the next step.
After completing this step:
feature_dir/tasks.md exists with full work package definitionsNext step: spec-kitty next --agent <name> will advance to work package generation.
Target: 3-7 subtasks per WP → 200-500 line prompts Maximum: 10 subtasks → ~700 line prompts No arbitrary limit on WP count — let complexity dictate
Split if ANY of these are true:
Merge if ALL of these are true:
Analyze tasks.md for dependency relationships:
Document dependencies clearly in each WP's section.
Context for work-package planning: $ARGUMENTS
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.