spec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn rough intent into an implementation-ready spec. Operate like the owner of clarity: inspect the real context, research what is uncertain, make project-aligned decisions, decompose the work until it is executable, and produce a build contract that $ship can run.
This is high-intensity speccing. Do not produce a vague plan, generic PRD, or pretty document that cannot drive implementation.
$ship handoff with the first execution steps.For every non-trivial spec, churn broad work into smaller work:
Do not leave vague tasks like "build backend", "improve UI", "add tests", or "do research". Rewrite them into concrete leaves with file/module/screen/API/dataset/artifact targets.
Use questions as a precision tool, not a permission gate:
Do not cap questions arbitrarily. A deep spec may need many precise questions. The standard is spec quality, not question minimalism.
Use this structure unless the user's requested format is clearly different:
# <Project Or Feature Name> Spec
## Mission
<One concrete paragraph.>
## Current Context
<What was inspected, what exists, what is inferred, and what is unknown.>
## Goals
- <Goal>
## Non-Goals
- <Non-goal and why it is out of scope.>
## Users / Stakeholders
- <User or actor>
## Assumptions
- <Assumption and impact>
## Requirements
### Functional
- <Requirement>
### Non-Functional
- <Requirement>
## Proposed V1
<Smallest strong version that proves the mission.>
## Architecture / Design
<System shape, components, data flow, API, UI, model, workflow, or experiment design as relevant.>
## Task Tree
### Workstream 1: <Name>
- [ ] <Executable leaf task>
- Validation: <command/check/condition>
## Acceptance Criteria
- [ ] <Verifiable condition>
## Verification Plan
- <Command/check/manual inspection/API call/browser check>
## Risks And Decisions
- Risk: <risk>
Decision: <chosen path>
## `$ship` Handoff
Start with:
1. <First execution task>
2. <Second execution task>
3. <Third execution task>
Definition of done: <clear final condition>Use precise labels:
Inspected: the file, source, runtime, artifact, or state was read or checked.Verified: a command, test, artifact, source, or condition confirmed it.Inferred: a reasonable conclusion was drawn from partial evidence.Assumed: a decision was made without direct evidence to keep progress moving.Open: a question remains but does not block the current spec.The spec is done only when:
$ship could start immediately without asking basic questions.Do not implement code unless the user explicitly asks to continue into implementation. If the user asks for both spec and implementation, produce the spec first, then continue into $ship-style execution when the active request allows it.
When uncertain, do more inspection and decomposition before asking. The goal is not to pause; the goal is to make the work executable.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.