spec-kitty-tasks-packages — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-kitty-tasks-packages (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Source: This skill augments the baseline workflow located at ./workflows/spec-kitty.tasks-packages.md. It acts as an intelligent wrapper that is continuously improved with each execution.<!-- spec-kitty-command-version: 3.0.3 -->
Version: 0.12.0+
Generate individual tasks/WP*.md prompt files from the outline in tasks.md. This step assumes tasks.md already exists with complete WP definitions.
IMPORTANT: This step works in the project root checkout. NO worktrees created.
In repos with multiple features, always pass `--feature <slug>` to every spec-kitty command.
$ARGUMENTSRun:
spec-kitty agent context resolve --action tasks_packages --jsonThen execute the returned check_prerequisites command and capture feature_dir. All paths must be absolute.
Read feature_dir/tasks.md — this must already exist from the previous step. Parse the work package definitions, subtask lists, and dependencies.
For each work package defined in tasks.md:
CRITICAL PATH RULE: All WP files MUST be created in a FLAT feature_dir/tasks/ directory, NOT in subdirectories!
feature_dir/tasks/WPxx-slug.md (flat, no subdirectories)feature_dir/tasks/planned/, feature_dir/tasks/doing/, or ANY status subdirectoriesFor each WP:
WPxx-slug.md (e.g., WP01-create-html-page.md)feature_dir/tasks/WP01-create-html-page.mdwork_package_id, subtasks array, dependencies, history entryrequirement_refs array from the WP's Requirement Refs line in tasks.mdowned_files, authoritative_surface, execution_mode (required ownership fields)tasks.md to reference the prompt filenameTARGET PROMPT SIZE: 200-500 lines per WP (3-7 subtasks) MAXIMUM PROMPT SIZE: 700 lines per WP (10 subtasks max) If prompts are >700 lines: Split the WP — it's too large
IMPORTANT: All WP files live in flat tasks/ directory. Status is managed via status.events.jsonl, not by directory location or frontmatter fields.
Each WP prompt file MUST include a dependencies field:
---
work_package_id: "WP02"
title: "Build API"
dependencies: ["WP01"] # From tasks.md
requirement_refs: ["FR-001", "NFR-001"] # From tasks.md Requirement Refs
subtasks: ["T001", "T002"]
owned_files: ["src/api/**"]
authoritative_surface: "src/api/"
execution_mode: "code_change"
---Include the correct implementation command:
spec-kitty implement WP01spec-kitty implement WP02 --base WP01Ownership rules:
owned_files: List of glob patterns for files this WP touches — no two WPs may overlap.authoritative_surface: Path prefix that must be a prefix of at least one owned_files entry.execution_mode: "code_change" for source code changes, "planning_artifact" for kitty-specs docs.owned_files list.After generating each prompt:
After completing this step:
feature_dir/tasks/WP*.md prompt files exist for all work packageswork_package_id, dependencies, owned_files, authoritative_surface, execution_modetasks.md references all prompt filenamesNext step: spec-kitty next --agent <name> will advance to finalization.
Good prompt (~60 lines per subtask):
### Subtask T001: Implement User Login Endpoint
**Purpose**: Create POST /api/auth/login endpoint that validates credentials and returns JWT token.
**Steps**:
1. Create endpoint handler in `src/api/auth.py`:
- Route: POST /api/auth/login
- Request body: `{email: string, password: string}`
- Response: `{token: string, user: UserProfile}` on success
- Error codes: 400, 401, 429
2. Implement credential validation:
- Hash password with bcrypt
- Use constant-time comparison
**Files**: `src/api/auth.py` (new, ~80 lines)
**Validation**: Valid credentials return 200 with tokenBad prompt (~20 lines per subtask):
### T001: Add auth
Steps: Create endpoint. Add validation. Test it.Context for work-package planning: $ARGUMENTS
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.