speccanvas — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speccanvas (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to produce and maintain Spec Canvas artifacts as portable YAML specs.
Treat the spec as the source of truth for structure and intent. Favor compact, reusable specs that can be pasted into Spec Canvas, an IDE, a terminal agent, or a repository without extra explanation.
Use the format-description YAML files in this skill as the writing guide. Use the bundled JSON Schema copies in this skill plus the local validation logic as the post-check.
Spec Canvas specs are a compact bridge between product intent and implementation. They should help agents and humans agree on the shape of the product before code changes, but they should not become a running log of every CSS, layout, or component tweak.
Before editing a UI Spec, decide whether the requested change is semantic enough to belong in the spec.
Update the UI Spec when the request changes:
Do not update the UI Spec for implementation micro-tweaks:
If the user asks for a cosmetic or layout micro-change, do the code change directly and explicitly avoid touching the UI Spec.
Unless the user explicitly asks for a different location, create and update Spec Canvas files in the project root under spec/.
spec/ui-spec.yamlspec/data-spec.yamlIf the spec/ directory does not exist, create it. When only one artifact is requested, create only the relevant file.
Determine whether the task needs:
For UI work, decide whether the request changes product intent/structure or only implementation details. If it is only a micro-tweak, leave the spec alone.
Use only the inputs that define structure:
Keep the document valid YAML and stay inside the format fields. Do not invent custom top-level sections unless the format explicitly allows them. Make the smallest semantic update that preserves intent; do not expand the spec with pixel-level implementation notes.
If scripts/validate-spec.mjs is available, run it against the final YAML before returning the result. Fix validation errors before returning the spec.
Return validated YAML or, for review tasks, return the issues first and the corrected snippet or file after that.
The format-description YAML files are the primary authoring reference for this skill. Follow their structure, field naming, examples, and guidance first. For UI Spec, references/ui-spec-format-0-0-3.yaml is the current local truth source and is expected to stay aligned with the bundled schema and validator.
Schema validation is not the writing guide. It is the final verification step.
scripts/validate-spec.mjs.The bundled schemas in schemas/ should stay synchronized with the Spec Canvas implementation and with the format-description references in this skill. If they appear to differ, treat that as a skill bug and call it out explicitly instead of silently inventing a compromise.
When both specs exist:
Produce plain YAML files that can live in a repo and be reused by any agent. Do not make the spec depend on Spec Canvas UI state, hidden metadata, or chat-only assumptions.
Do not use UI Spec as a replacement for CSS, component docs, or changelogs. A good purpose explains what the screen or block is for from the user's point of view. It should not enumerate exact spacing, class names, pixel sizes, transient implementation mechanics, or every small control if those details do not change the product meaning.
docType, format_version, and metadata.metadata.description is required and should carry the top-level product intent.screens as soon as the main app shape is known.blocks when the user wants visible structure; blocks may be omitted at exploration stage.templates, navigation, or responsive fields only when they materially help.metadata.breakpoints, adaptive screen.template, adaptive block.columns, and block.visible.scripts/validate-spec.mjs when available.enums only when shared controlled vocabularies matter.entities with business-meaningful fields.relations for logical cross-entity structure.scripts/validate-spec.mjs when available.Check for:
purpose text that describes implementation mechanics instead of product intentWhen repairing, preserve the original product intent and make the smallest correction that restores clarity.
purpose paragraphs with one-sentence summaries of user-facing intent.Use scripts/validate-spec.mjs when available.
docTypeIf the script cannot run because the local Spec Canvas dependencies are missing, say so briefly and fall back to manual review using the format file plus the validation-rules references.
When returning specs:
When returning a review instead of a rewritten file:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.