speckit-analyze — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-analyze (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
$ARGUMENTSYou MUST consider the user input before proceeding (if not empty).
Check for extension hooks (before analysis):
.specify/extensions.yml exists in the project root.hooks.before_analyze keyenabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: true): ## Extension Hooks
**Optional Pre-Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Pre-Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}
Wait for the result of the hook command before proceeding to the Goal..specify/extensions.yml does not exist, skip silentlyIdentify inconsistencies, duplications, ambiguities, and underspecified items across the three core artifacts (spec.md, plan.md, tasks.md) before implementation. This command MUST run only after /speckit-tasks has successfully produced a complete tasks.md.
STRICTLY READ-ONLY: Do not modify any files. Output a structured analysis report. Offer an optional remediation plan (user must explicitly approve before any follow-up editing commands would be invoked manually).
Constitution Authority: The project constitution (.specify/memory/constitution.md) is non-negotiable within this analysis scope. Constitution conflicts are automatically CRITICAL and require adjustment of the spec, plan, or tasks—not dilution, reinterpretation, or silent ignoring of the principle. If a principle itself needs to change, that must occur in a separate, explicit constitution update outside /speckit-analyze.
Run .specify/scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks once from repo root and parse JSON for FEATURE_DIR and AVAILABLE_DOCS. Derive absolute paths:
Abort with an error message if any required file is missing (instruct the user to run missing prerequisite command). For single quotes in args like "I'm Groot", use escape syntax: e.g 'I'\''m Groot' (or double-quote if possible: "I'm Groot").
Load only the minimal necessary context from each artifact:
From spec.md:
From plan.md:
From tasks.md:
From constitution:
.specify/memory/constitution.md for principle validationCreate internal representations (do not include raw artifacts in output):
user-can-upload-file). Include only Success Criteria items that require buildable work (e.g., load-testing infrastructure, security audit tooling), and exclude post-launch outcome metrics and business KPIs (e.g., "Reduce support tickets by 50%").Focus on high-signal findings. Limit to 50 findings total; aggregate remainder in overflow summary.
#### A. Duplication Detection
#### B. Ambiguity Detection
<placeholder>, etc.)#### C. Underspecification
#### D. Constitution Alignment
#### E. Coverage Gaps
#### F. Inconsistency
Use this heuristic to prioritize findings:
Output a Markdown report (no file writes) with the following structure:
| ID | Category | Severity | Location(s) | Summary | Recommendation |
|---|---|---|---|---|---|
| A1 | Duplication | HIGH | spec.md:L120-134 | Two similar requirements ... | Merge phrasing; keep clearer version |
(Add one row per finding; generate stable IDs prefixed by category initial.)
Coverage Summary Table:
| Requirement Key | Has Task? | Task IDs | Notes |
|---|
Constitution Alignment Issues: (if any)
Unmapped Tasks: (if any)
Metrics:
At end of report, output a concise Next Actions block:
/speckit-implementAsk the user: "Would you like me to suggest concrete remediation edits for the top N issues?" (Do NOT apply them automatically.)
After reporting, check if .specify/extensions.yml exists in the project root.
hooks.after_analyze keyenabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: true): ## Extension Hooks
**Optional Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}.specify/extensions.yml does not exist, skip silently$ARGUMENTS
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.