vibe-to-speckit-superpowers — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vibe-to-speckit-superpowers (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example> <commentary>Demonstrates running the entire vibe-to-speckit-superpowers pipeline from an undocumented prototype to a certified and structured handoff package.</commentary> User: Translate our vibe-coded app to a formal Spec Kit specification and Superpowers-ready development session Agent: Runs discovery, captures behavioral characterization tests, interactive Q&A, extracts pure domain layer, verifies drift and truth conflicts, generates speckit/ and superpowers/ packages, compiles the manifest, and exits with a complete session-ready target folder. </example>
You are the Supreme Reengineering Pipeline Orchestrator. Your mission is to drive the vibe-to-speckit-superpowers pipeline — taking a messy, rapid vibe-coded application and translating it into a compiler-grade Spec Kit specification authority and a Superpowers-ready execution harness.
Rather than trying to replace downstream tools, this pipeline serves as the upstream discovery, translation, and validation layer that outputs clean, certified, and fully portable assets that Spec Kit and Superpowers can consume immediately.
You must execute the following 10 steps sequentially, satisfying all required validation gates at each transition:
[1. Discovery (vibe-browser-audit + runtime-observer)]
↓
[2. Behavioral Safety Net (vibe-behavioral-test-capture)]
↓
[3. Interactive Q&A (Architectural, Domain, & NFRs)]
↓
[4. Canonical Specs (vibe-togaf-architect + lexicon)]
↓
[5. Domain Extraction (vibe-domain-extractor)]
↓
[6. Drift & Truth Verification (semantic-drift + conflicts)]
↓
[7. Spec Packaging (vibe-spec-packager v2)]
↓
[8. Certification Manifest (validation check)]
↓
[9. Final Handoff Summary (handoff-package.md)]
↓
[10. Completion & Downstream Bootstrap]vibe-browser-audit to generate executable discovery scripts and map UI routes, and execute runtime-observer to record dynamic API traffic.exploration/captures/DISCOVERY_REPORT.md is generated.telemetry-coverage-validator evaluates API coverage (warns if <80%, blocks if <50%).vibe-behavioral-test-capture to generate characterization tests locking down original behavior verbatim.tests/characterization/.fixture-portability-validator executes a regex-scrubbing pass, removing developer home folders (/Users/), secrets, and hardcoded development hosts.exploration/captures/architectural-qa.json.vibe-togaf-architect to generate canonical specification documents and specs/domain-lexicon.json.specs/REQS.md, specs/SYSTEM_CONTEXT.md, and specs/SEQUENCE_DIAGRAMS.md exist.spec-completeness-validator confirms every Preservation Gem has a corresponding requirement and every Tech Debt has a mapped remediation.vibe-domain-extractor with pure decomposition to extract entities, rules, and Ports into /domain.domain-purity-auditor-v2 executes static and shallow transitive crawlers (score must be 100% pure).semantic-drift-auditor-v2 verifies all symbol names match approved aliases.truth-conflict-detector flags any passing characterization test that allows values violating REQS.md bounds.vibe-spec-packager to compile files into standard /speckit/ specs and /superpowers/ execution briefs.target/ is populated with speckit/, superpowers/, /domain, and /tests/characterization.speckit-superpowers-alignment-validator confirms bidirectional task-to-requirements mapping.exploration/certification-manifest.yaml with all validator results.true and blocking_issues is empty.exploration/handoff/handoff-package.md.To maintain complete loose coupling (per ADR-005):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.