speckit-specify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-specify (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
$ARGUMENTSYou MUST consider the user input before proceeding (if not empty).
Check for extension hooks (before specification):
.specify/extensions.yml exists in the project root.hooks.before_specify keyenabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: true): ## Extension Hooks
**Optional Pre-Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Pre-Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}
Wait for the result of the hook command before proceeding to the Outline..specify/extensions.yml does not exist, skip silentlyThe text the user typed after /speckit-specify in the triggering message is the feature description. Assume you always have it available in this conversation even if $ARGUMENTS appears literally below. Do not ask the user to repeat it unless they provided an empty command.
Given that feature description, do this:
If a before_specify hook ran successfully in the Pre-Execution Checks above, it will have created/switched to a git branch and output JSON containing BRANCH_NAME and FEATURE_NUM. Note these values for reference, but the branch name does not dictate the spec directory name.
If the user explicitly provided GIT_BRANCH_NAME, pass it through to the hook so the branch script uses the exact value as the branch name (bypassing all prefix/suffix generation).
Specs live under the default specs/ directory unless the user explicitly provides SPECIFY_FEATURE_DIRECTORY.
Resolution order for `SPECIFY_FEATURE_DIRECTORY`:
SPECIFY_FEATURE_DIRECTORY (e.g., via environment variable, argument, or configuration), use it as-isspecs/:.specify/init-options.json for branch_numbering"timestamp": prefix is YYYYMMDD-HHMMSS (current timestamp)"sequential" or absent: prefix is NNN (next available 3-digit number after scanning existing directories in specs/)<prefix>-<short-name> (e.g., 003-user-auth or 20260319-143022-user-auth)SPECIFY_FEATURE_DIRECTORY to specs/<directory-name>Create the directory and spec file:
mkdir -p SPECIFY_FEATURE_DIRECTORY.specify/templates/spec-template.md to SPECIFY_FEATURE_DIRECTORY/spec.md as the starting pointSPEC_FILE to SPECIFY_FEATURE_DIRECTORY/spec.md.specify/feature.json: {
"feature_directory": "<resolved feature dir>"
}Write the actual resolved directory path value (for example, specs/003-user-auth), not the literal string SPECIFY_FEATURE_DIRECTORY. This allows downstream commands (/speckit-plan, /speckit-tasks, etc.) to locate the feature directory without relying on git branch name conventions.
IMPORTANT:
/speckit-specify invocation.specify/templates/spec-template.md to understand required sections.If empty: ERROR "No feature description provided"
Identify: actors, actions, data, constraints
If no clear user flow: ERROR "Cannot determine user scenarios"
Each requirement must be testable Use reasonable defaults for unspecified details (document assumptions in Assumptions section)
Create measurable, technology-agnostic outcomes Include both quantitative metrics (time, performance, volume) and qualitative measures (user satisfaction, task completion) Each criterion must be verifiable without implementation details
a. Create Spec Quality Checklist: Generate a checklist file at SPECIFY_FEATURE_DIRECTORY/checklists/requirements.md using the checklist template structure with these validation items:
# Specification Quality Checklist: [FEATURE NAME]
**Purpose**: Validate specification completeness and quality before proceeding to planning
**Created**: [DATE]
**Feature**: [Link to spec.md]
## Content Quality
- [ ] No implementation details (languages, frameworks, APIs)
- [ ] Focused on user value and business needs
- [ ] Written for non-technical stakeholders
- [ ] All mandatory sections completed
## Requirement Completeness
- [ ] No [NEEDS CLARIFICATION] markers remain
- [ ] Requirements are testable and unambiguous
- [ ] Success criteria are measurable
- [ ] Success criteria are technology-agnostic (no implementation details)
- [ ] All acceptance scenarios are defined
- [ ] Edge cases are identified
- [ ] Scope is clearly bounded
- [ ] Dependencies and assumptions identified
## Feature Readiness
- [ ] All functional requirements have clear acceptance criteria
- [ ] User scenarios cover primary flows
- [ ] Feature meets measurable outcomes defined in Success Criteria
- [ ] No implementation details leak into specification
## Notes
- Items marked incomplete require spec updates before `/speckit-clarify` or `/speckit-plan`b. Run Validation Check: Review the spec against each checklist item:
c. Handle Validation Results:
## Question [N]: [Topic]
**Context**: [Quote relevant spec section]
**What we need to know**: [Specific question from NEEDS CLARIFICATION marker]
**Suggested Answers**:
| Option | Answer | Implications |
|--------|--------|--------------|
| A | [First suggested answer] | [What this means for the feature] |
| B | [Second suggested answer] | [What this means for the feature] |
| C | [Third suggested answer] | [What this means for the feature] |
| Custom | Provide your own answer | [Explain how to provide custom input] |
**Your choice**: _[Wait for user response]_| Content | not |Content||--------|d. Update Checklist: After each validation iteration, update the checklist file with current pass/fail status
SPECIFY_FEATURE_DIRECTORY — the feature directory pathSPEC_FILE — the spec file path/speckit-clarify or /speckit-plan).specify/extensions.yml exists in the project root.hooks.after_specify keyenabled is explicitly false. Treat hooks without an enabled field as enabled by default.condition expressions:condition field, or it is null/empty, treat the hook as executablecondition, skip the hook and leave condition evaluation to the HookExecutor implementation.) with hyphens (-). For example, speckit.git.commit → /speckit-git-commit.optional flag:optional: true): ## Extension Hooks
**Optional Hook**: {extension}
Command: `/{command}`
Description: {description}
Prompt: {prompt}
To execute: `/{command}`optional: false): ## Extension Hooks
**Automatic Hook**: {extension}
Executing: `/{command}`
EXECUTE_COMMAND: {command}.specify/extensions.yml does not exist, skip silentlyNOTE: Branch creation is handled by the before_specify hook (git extension). Spec directory and file creation are always handled by this core command.
When creating this spec from a user prompt:
Examples of reasonable defaults (don't ask about these):
Success criteria must be:
Good examples:
Bad examples (implementation-focused):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.