create-spec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-spec (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the spec creation workflow. This process gathers requirements through an adaptive, multi-round interview and generates a comprehensive specification document.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Text output should only be used for:
If you need the user to make a choice or provide input, use AskUserQuestion.
NEVER do this (asking via text output):
What features are most important to you?
1. Performance
2. Usability
3. SecurityALWAYS do this (using AskUserQuestion tool):
AskUserQuestion:
questions:
- header: "Priority"
question: "What features are most important to you?"
options:
- label: "Performance"
description: "Speed and responsiveness"
- label: "Usability"
description: "Ease of use"
- label: "Security"
description: "Data protection"
multiSelect: trueCRITICAL: This skill generates a spec document, NOT an implementation plan. When invoked during Claude Code's plan mode:
The spec is a planning artifact itself — generating it IS the planning activity.
When codebase exploration is triggered (Phase 2, "new feature" type), load the teams reference for the Parallel Specialists exploration pattern:
Read ${CLAUDE_PLUGIN_ROOT}/../claude-tools/skills/claude-code-teams/SKILL.mdThis provides TeamCreate, SendMessage, and team lifecycle conventions used in the codebase exploration procedure.
This workflow has six phases:
Check if there is a settings file at .claude/agent-alchemy.local.md to get any custom configuration like output path or author name.
If $ARGUMENTS is provided, load user-supplied context before gathering initial inputs:
.md, .txt, or .markdown; or starts with /, ./, ../, or ~; or contains path separators and the file exists) → read the file using the Read toolIf $ARGUMENTS is empty, skip this subsection entirely — the skill behaves exactly as before.
If user-supplied context was loaded, assess its complexity:
references/complexity-signals.md for signal definitions and thresholdsAskUserQuestion: questions:
- header: "Complexity"
question: "This appears to involve significant complexity (e.g., {top 2-3 complexity areas}). The interview will be more thorough to ensure complete coverage. Ready to proceed?"
options:
- label: "Yes, let's be thorough"
description: "Use expanded interview budgets for deeper coverage"
- label: "Keep it brief"
description: "Use standard interview budgets"
multiSelect: falsecomplexity_detected flag for expanded budgetsUse AskUserQuestion to gather the essential starting information with these four questions:
Question 1 - Spec Name:
Question 2 - Type:
Question 3 - Depth:
Question 4 - Description:
Before starting Round 1, read these reference files to load the full question bank and trigger patterns:
references/interview-questions.md — Question bank organized by category and depth levelreferences/recommendation-triggers.md — Trigger patterns for proactive recommendations across all domainsUse these as your primary source for questions and trigger detection throughout the interview.
#### Depth-Aware Questioning
Adapt your interview depth based on the requested level:
High-level overview (2-3 rounds):
Detailed specifications (3-4 rounds):
Full technical documentation (4-5 rounds):
#### Question Categories
Cover all four categories, but adjust depth based on level:
#### Expanded Budgets
When complexity_detected is set (user opted in after complexity assessment), use expanded budgets from references/interview-questions.md (section "Expanded Budgets (Complexity Detected)") instead of the standard budgets above. Soft ceiling of ~8 rounds / ~35 questions applies.
#### Adaptive Behavior
#### Context-Informed Questioning
When user-supplied context was loaded in Phase 2, apply these strategies throughout the interview:
Each round MUST:
AskUserQuestion — REQUIRED, never use text for questionsQuestion Guidelines:
Example Question Patterns:
For structured choices:
header: "Priority"
question: "What priority is this feature?"
options:
- label: "P0 - Critical"
description: "Must have for initial release"
- label: "P1 - High"
description: "Important but can follow fast"
- label: "P2 - Medium"
description: "Nice to have"For open-ended input:
header: "Problem"
question: "What specific problem are you trying to solve?"
options:
- label: "Efficiency"
description: "Users spend too much time on manual tasks"
- label: "Quality"
description: "Current solution produces errors or poor results"
- label: "Access"
description: "Users can't do something they need to do"Throughout the interview, watch for patterns in user responses that indicate opportunities for best-practice recommendations. When detected, offer relevant suggestions based on industry standards.
Trigger Detection: After receiving user responses each round, scan for trigger keywords from the loaded references/recommendation-triggers.md. The file covers domains including: Authentication, Scale & Performance, Security & Compliance, Real-Time Features, File & Media, API Design, Search & Discovery, Testing, and Accessibility.
When to Offer Recommendations:
Inline Insight Format:
AskUserQuestion:
questions:
- header: "Quick Insight"
question: "{Brief recommendation}. Would you like to include this in the spec?"
options:
- label: "Include this"
description: "Add to spec requirements"
- label: "Tell me more"
description: "Get more details"
- label: "Skip"
description: "Continue without this"
multiSelect: falseFor detailed recommendation templates, refer to: references/recommendation-format.md
Tracking Recommendations: Maintain internal tracking of detected triggers and accepted recommendations:
Trigger Detection per Round:
If the product type is "New feature for existing product":
${CLAUDE_PLUGIN_ROOT}/skills/create-spec/references/codebase-exploration.mdError handling / fallback: If exploration agents fail (Task tool errors, agent timeouts, etc.):
AskUserQuestion to offer fallback: questions:
- header: "Fallback"
question: "Codebase exploration encountered an issue. How would you like to proceed?"
options:
- label: "Quick exploration"
description: "Fall back to basic Glob/Grep/Read exploration"
- label: "Skip"
description: "Continue without codebase analysis"
multiSelect: falseWhen codebase exploration was performed (deep or quick), use the findings throughout the interview:
Store findings internally as "Codebase Context" and reference throughout interview and spec compilation.
Research can be invoked in two ways: on-demand when the user requests it, or proactively for specific high-value topics.
#### On-Demand Research
When the user explicitly requests research about technologies or general topics during the interview, invoke the research agent.
Technical research triggers:
General topic research triggers:
#### Proactive Research
You MAY proactively research (without explicit user request) for specific high-value topics:
Auto-research triggers:
Proactive research limit: Maximum 2 proactive research calls per interview to avoid slowing down the process.
Before proactive research, briefly inform the user:
Since you mentioned GDPR compliance, let me quickly research the current requirements to ensure we capture them accurately.#### Invoking Research
Use the Task tool with subagent_type researcher:
Task prompt template:
"Research {topic} for spec '{spec_name}'.
Context: {What section of the spec this relates to}
Depth level: {high-level/detailed/full-tech}
Specific questions:
- {Question 1}
- {Question 2}
Return findings in spec-ready format."#### Incorporating Research Findings
After receiving research results:
#### Tracking Research Usage
Track proactive research usage during the interview:
Proactive Research: 1/2 used
- [Round 2] GDPR requirements - informed compliance recommendationIf the user indicates they want to wrap up early (signals like "I think that's enough", "let's wrap up", "that covers it", "skip the rest"), handle it gracefully:
AskUserQuestion to confirm: questions:
- header: "Early Completion"
question: "Here's what I've gathered so far. Should I generate the spec with this information, or would you like to add anything?"
options:
- label: "Generate spec"
description: "Proceed with what we have"
- label: "Add more"
description: "I want to provide additional details"
multiSelect: false**Status**: Draft (Partial) to the spec metadata to indicate incomplete coverageAfter completing the main interview rounds and before the summary, present a dedicated recommendations round.
Present recommendations organized by category:
Introduce the recommendations round briefly:
Based on what you've shared, I have a few recommendations based on industry best practices.
I'll present each for your review — you can accept, modify, or skip any of them.Then present each recommendation using AskUserQuestion:
AskUserQuestion:
questions:
- header: "Recommendation {N} of {Total}: {Category}"
question: "{Recommendation}\n\n**Why this matters:**\n{Brief rationale}"
options:
- label: "Accept"
description: "Include in spec"
- label: "Modify"
description: "Adjust this recommendation"
- label: "Skip"
description: "Don't include"
multiSelect: falseIf user selects "Modify":
AskUserQuestionAfter the recommendations round, update internal tracking:
Before compilation, present a comprehensive summary:
## Requirements Summary
### Problem & Goals
- Problem: {summarized problem statement}
- Success Metrics: {list metrics}
- Primary User: {persona description}
- Business Value: {why this matters}
### Functional Requirements
{List each feature with acceptance criteria}
### Technical Specifications
- Tech Stack: {choices or constraints}
- Integrations: {systems to integrate with}
- Performance: {requirements}
- Security: {requirements}
### Implementation
- Phases: {list phases}
- Dependencies: {list dependencies}
- Risks: {list risks}
- Out of Scope: {list exclusions}
### Agent Recommendations (Accepted)
*The following recommendations were suggested based on industry best practices and accepted during the interview:*
1. **{Category}**: {Recommendation title}
- Rationale: {Why this was recommended}
- Applies to: {Which section/feature}
{Continue for all accepted recommendations, or note "No recommendations accepted" if none}
### Open Questions
{Any unresolved items}Important: Clearly distinguish the "Agent Recommendations" section from user-provided requirements. This transparency helps stakeholders understand which requirements came from the user versus agent suggestions.
Then use AskUserQuestion to confirm:
questions:
- header: "Summary Review"
question: "Is this requirements summary accurate and complete?"
options:
- label: "Yes, proceed to spec"
description: "Summary is accurate, generate the spec"
- label: "Needs corrections"
description: "I have changes or additions"
multiSelect: falseIf user selects "Needs corrections", ask what they'd like to change using AskUserQuestion, then update the summary and confirm again.
Never skip the summary confirmation step. Only proceed to compilation after user explicitly confirms via AskUserQuestion.
Choose the appropriate template based on depth level:
| Depth Level | Template | Use Case |
|---|---|---|
| High-level overview | references/templates/high-level.md | Executive summaries, stakeholder alignment, initial scoping |
| Detailed specifications | references/templates/detailed.md | Standard development specs with clear requirements |
| Full technical documentation | references/templates/full-tech.md | Complex features requiring API specs, data models, architecture |
For "Detailed specifications" and "Full technical documentation" depth levels, load the technical-diagrams skill before compilation:
Read ${CLAUDE_PLUGIN_ROOT}/../core-tools/skills/technical-diagrams/SKILL.mdApply its styling rules when generating Mermaid diagrams in the spec — use classDef with color:#000 for all node styles. For "High-level overview" depth, skip diagram loading.
.claude/agent-alchemy.local.md for:# {spec-name} PRD**Spec Type**: The product type selected during the interview**Spec Depth**: The depth level selected**Description**: The initial description provided by the user**Status**: Draft (Partial)specs/{name}-SPEC.md)#### Requirement Formatting
### REQ-001: [Requirement Name]
**Priority**: P0 (Critical) | P1 (High) | P2 (Medium) | P3 (Low)
**Description**: Clear, concise statement of what is needed.
**Acceptance Criteria**:
- [ ] Criterion 1
- [ ] Criterion 2
**Notes**: Any additional context or constraints.#### User Story Format
**As a** [user type]
**I want** [capability]
**So that** [benefit/value]#### API Specification Format (Full Tech Only)
#### Endpoint: `METHOD /path`
**Purpose**: Brief description
**Request**:
- Headers: `Content-Type: application/json`
- Body:{ "field": "type - description" }
**Response**:
- `200 OK`: Success response schema
- `400 Bad Request`: Validation errors
- `401 Unauthorized`: Authentication requiredThese principles guide how specs should be structured:
Specs should define clear phases with completion criteria rather than time estimates:
Every requirement should include:
Define explicit points where human review is required:
Structure specs for optimal AI assistant consumption:
references/interview-questions.md — Question bank organized by category and depth level (includes expanded budgets for complex projects)references/complexity-signals.md — Signal definitions, thresholds, and assessment format for complexity detectionreferences/recommendation-triggers.md — Trigger patterns for proactive recommendationsreferences/recommendation-format.md — Templates for presenting recommendationsreferences/templates/high-level.md — Streamlined executive overview templatereferences/templates/detailed.md — Standard spec template with all sectionsreferences/templates/full-tech.md — Extended template with technical specifications~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.