writing-specs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited writing-specs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transform a feature request into a specification rigorous enough to implement without further clarification. Every section is a binding contract between architect and implementer. Ambiguity in a spec causes real engineering delay; design errors caught here are orders of magnitude cheaper than design errors caught in code review.
This skill is stack-agnostic and project-agnostic. Concrete rules (allowed libraries, forbidden patterns, budget thresholds, schema location, layering, naming) come from the project documents, not from this skill. Read those documents first; then design within them; then flag every deviation explicitly.
Script paths in this document (e.g. scripts/) are resolved relative to this SKILL.md file, not to your current working directory. If a relative command fails to resolve, prefix it with the path your platform loaded this SKILL.md from.
Fallback. If python3 cannot be located, analyze the script's purpose and logic and execute its intent with available tools, but warn the user that python is not available and the logic was executed with a fallback approach that may not be perfect.
These documents are the authority your specification must conform to. Do not start designing until you have read whichever of them the project ships. Stop reading once you have enough; do not load files that do not exist.
CLAUDE.md, AGENTS.md, GEMINI.md. Read every file that exists; do not assume any of them is canonical. When they disagree, treat the most recently modified one as authoritative and surface the conflict in your output.docs/ exists, read docs/README.md (or the closest equivalent: docs/index.md, docs/SUMMARY.md, docs/DIGEST.md). Use it as a map. Open the individual documents it references only when they constrain the feature you are specifying.architecture.md, ARCHITECTURE.md, design.md, PRD.md, product.md, or whatever name the project uses.docs/decisions/, docs/adr/, adr/, ADR/, or whatever path the project uses. Read the index file first; read individual records only when they constrain this feature. Treat accepted decisions as architectural law..agents/rules/, .github/instructions/, .copilot/instructions/, .claude/rules/, or referenced from the agent-instruction file. These constrain spec prose (RFC 2119 keywords, banned vocabulary, comment style, etc.).If the project ships none of the above, say so explicitly in the specification's opening section. Note that the spec is being written without project-context grounding and propose what context files the project should add.
When a digest and its full document disagree, the full document wins. Digests are lossy summaries; if you spot drift, flag it.
The specification input is one of:
Four phases, executed sequentially. Do not skip a phase, do not reorder phases, do not collapse two phases into one. Each phase has a defined gate; the gates exist because skipping any of them produces a defect class that surfaces later.
Copy this checklist into your reasoning trace and mark items as you complete them:
Read the files listed in "Project context: reading order" above. Extract concrete, named constraints, not impressions:
If a tracker reference was provided, fetch it now and capture: acceptance criteria, linked design pages, labels, components, scope flags.
Before designing anything, run all nine cross-cutting checks. Each one produces a GO, STOP, or FLAG decision. See references/analysis-protocol.md for the full protocol with concrete questions, evidence rules, and decision criteria.
Summary of the nine checks:
After running all nine checks, record one verdict per check using the template at the end of references/analysis-protocol.md. Copy the verdicts into both the agent's reasoning trace and the spec's opening "Compliance check" table. A check the agent did not run is not acceptable; either run it or state explicitly why it does not apply.
If any check produces a STOP, surface the conflict and halt. Do not proceed until the user resolves it. If any check produces a FLAG, document it explicitly in the spec as a deliberate extension requiring review. A specification that silently violates an accepted decision is worse than no specification.
Determine the output path:
.specs/ already exists in the repository, use it.docs/specs/ or specs/ exists, use that..specs/ and create it.File name: Spec-{slug}.md. Derive {slug} in this order:
BP-138, SORT-42, #238), use it: Spec-BP-138.md, Spec-238-codex-agent-adapter.md.Spec-Email-Classification.md.Use the same slug across all related artifacts (spec, review, plan) so traceability is automatic.
Use the template in assets/spec-template.md as the structural foundation. Fill every section. Do not leave placeholders. Each section that genuinely cannot be filled MUST include a note explaining why and what information is needed to fill it.
#### Output rules
These rules are non-negotiable. Every rule reflects a class of defect that delays implementation.
WHAT, not HOW. Pseudo-code is allowed; runnable code is not.actor -> actor: action lines. Do not emit Mermaid or ASCII diagrams; the spec's downstream readers (validator, implementer agent) consume the same information from tables and pseudo-code without the rendering layer that makes diagrams useful to humans, and a duplicated format multiplies the surface where prose, pseudo-code, and diagram can drift.[Section 5.1](../docs/architecture.md#51-tier-0), per ADR-0014, per CLAUDE.md "Never" boundary. Every design decision that traces to project context gets a citation. Every decision that does not MUST be flagged as a spec extension requiring review.STOP from Phase 2 and the spec does not get written until resolved.Load references/quality-checklist.md and run every item in it against the drafted spec. The checklist combines IEEE 830 / ISO 29148 requirement-quality attributes (Correct, Unambiguous, Complete, Consistent, Ranked, Verifiable, Modifiable, Traceable) with a catalogue of the most frequent spec-quality defects (vague verbs, missing error paths, implicit ordering, unspecified defaults, orphaned references, oversized steps, quantifiers without thresholds, cross-references to unnamed components, banned vocabulary).
Apply the "two engineers test" to every numbered requirement: can two engineers read the requirement and reach the same implementation? If not, rewrite with concrete values, explicit types, or a worked example.
If scripts/validate_spec.py is bundled with this skill and python3 is available, run it for mechanical structural checks (filename pattern, required sections present, risk-table data rows, no em-dashes, forward-slash paths). Treat its output as a complement to the manual checklist, not a replacement.
If validation fails, fix the issues and re-run the checklist. Do not report the spec complete until every item passes.
The spec is prose with structure. Follow these rules, deriving project-specific overrides from the style rules read in Phase 1.
When the project's style rules conflict with the rules above, the project's style rules win for prose specific to that project. The rules above are the floor.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.