sparc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sparc (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<objective> Drive a SPARC pass: Specification → Pseudocode → Architecture → Refinement → Completion. Each phase is gated by an artifact you produce before moving on. Track every phase as a TodoWrite item so the user sees progress and can interrupt at any boundary. </objective>
<when_to_use>
Pick SPARC over APEX when:
Pick APEX over SPARC when:
One-line rule of thumb: if you'd benefit from writing the algorithm in comments first, use SPARC. If you'd benefit from a checklist of files to touch first, use APEX.
Examples
lib/queries.ts into hooks/use-*.ts files following the existing pattern" → APEX (mechanical, the shape is known).</when_to_use>
<workflow>
Always start by recording the 5 phases as a TodoWrite list, then walk through them one by one. Mark in_progress before working a phase and completed only after the phase artifact is produced.
1. Specification — pending
2. Pseudocode — pending
3. Architecture — pending
4. Refinement — pending
5. Completion — pendingOutput: a short spec (≤30 lines) the user can react to.
Capture:
If anything is fuzzy, use AskUserQuestion once at this phase to lock the unknowns before drawing pseudocode. Don't ask later.
Output: a pseudocode sketch (commented prose, no real syntax) of the core algorithm or data flow.
This is the phase that distinguishes SPARC from APEX. Write the algorithm in plain English / structured comments before picking files, classes, or framework idioms.
Format suggestion:
# Goal: <one line>
# Inputs: <shape>
# Outputs: <shape>
step 1: read all PDF transactions, normalize references
step 2: filter to debits with reference >=8 digits AND ref appears >=2 times
step 3: cluster by amount ±5%
step 4: for each cluster:
if distinct months >= 3 AND avg/month <= 1: keep
else: drop
step 5: emit one sub-credit per surviving clusterValidate the pseudocode against 1-2 worked examples on paper (real or invented inputs) before moving on. If a corner case breaks the sketch, revise the sketch — not the (non-existent) code.
Output: a file-level decomposition with module boundaries and interfaces.
Now translate the pseudocode into a concrete shape:
Use sub-agents for parallel exploration here when useful. Examples:
Agent with Read/Grep/Glob).Run them in parallel when they're independent; consolidate the findings before drafting interfaces.
Don't write implementation code yet — only signatures, types, and 1-line descriptions per function.
Output: the working implementation, after at least one revision pass.
This is the second phase that distinguishes SPARC from APEX. APEX's "execute" produces an implementation; SPARC explicitly budgets a second pass on it.
Sequence:
Common refinements that earn their keep:
If the v1 is genuinely fine, document why in a one-line comment and move on. Don't pad refinement with cosmetic changes.
Output: verified, shipped work.
tsc --noEmit, eslint, vitest, etc.).Mark all 5 todos as completed only when the user-visible behavior is verified, not just when the code compiles.
</workflow>
<anti_patterns>
# step N: comments, not TypeScript.</anti_patterns>
<reporting>
When done, hand back:
Keep the report under 15 lines. Save artifacts (spec, pseudocode) inline in the relevant code as comments when they help the next reader; don't create extra .md files unless the user asked.
</reporting>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.