Generate industry-standard specifications — PRD, SRS, Technical Design, and Test Plan — each usable standalone or as part of a full traceability chain
SaferSkills independently audited spec-forge (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Spec-forge is a documentation and specification workflow suite. This root skill is the Codex-facing orchestrator: decide which child skill to load, keep the document chain coherent, and avoid loading large generation references until they are needed.
Use this skill when the user asks for any of the following:
skills/idea/SKILL.mdskills/decompose/SKILL.mdskills/prd-generation/SKILL.mdskills/srs-generation/SKILL.mdskills/tech-design-generation/SKILL.mdskills/test-cases-generation/SKILL.mdskills/review/SKILL.mdskills/audit/SKILL.mdskills/analyze/SKILL.mdskills/propagate/SKILL.md[idea] -> [decompose] -> [prd] -> srs -> tech-design -> review -> handoff to code-forgeRouting the ambiguous "write me a requirements document". When the user says "需求文档", "requirements doc", or "spec" without qualifying it, the deciding question is whether the decision to build has already been made. If it has — the user knows what they want and needs it specified precisely enough to implement against — route to SRS. If it has not — the user is making a case, seeking approval, or sizing an opportunity — route to PRD. When genuinely unclear, ask that one question rather than guessing; producing the wrong document wastes the entire generation.
Also treat slash-like requests as aliases:
| User request | Route |
|---|---|
/spec-forge <name> | Full chain |
/spec-forge:idea <name> or /idea <name> | Idea |
/spec-forge:decompose <name> or /decompose <name> | Decompose |
/spec-forge:tech-design <name> or /tech-design <name> | Tech Design |
/spec-forge:prd <name> or /prd <name> | PRD |
/spec-forge:srs <name> or /srs <name> | SRS |
/spec-forge:test-cases <target> or /test-cases <target> | Test Cases |
/spec-forge:review <name> or /review <name> | Review |
/spec-forge:audit [path] or /audit [path] | Audit |
/spec-forge:analyze [path] or /analyze [path] | Analyze |
/spec-forge:propagate ... or /propagate ... | Propagate |
The commands/*.md files are compatibility command definitions from the original Claude-oriented implementation. In Codex, prefer reading the child skills/*/SKILL.md files directly. Use commands/spec-forge.md only as an additional orchestration reference if you need more detail about the full chain.
Keep context small.
SKILL.md matching the user's request.skills/shared/project-context.md, read it if the workflow needs code/project awareness.skills/shared/doc-first.md, apply it before generating or editing docs.skills/shared/scripts.md once to resolve <sf_scripts>; do not read the scripts' source unless you need to debug them.Do not bulk-load every child skill. Do not read every reference folder just because the suite is complex.
prd-v2.md, new-tech-design.md, or addendum files. Edit the canonical file in place unless no canonical document exists.For generation workflows that need grounding in the actual codebase, use:
skills/shared/project-context.md
Apply it before SRS, PRD, tech-design, decompose, and test-cases work when the project exists. It produces a concise summary of:
For the full chain, scan project context once and reuse the summary across stages instead of repeatedly rescanning the same repository.
spec-forge ships a small layer of deterministic Python 3 (standard-library-only) helpers under skills/shared/scripts/ that absorb the mechanical, token-heavy bookkeeping the skills used to do by hand — project + document scanning (sf-scan.py), configuration/directory resolution (sf-config.py), document structure/ID validation (sf-verify-doc.py), and traceability/coverage math (sf-trace.py). The division of labour: the scripts keep the record-keeping; the model keeps the reasoning (requirement quality, architecture trade-offs, conflict judgement). Every skill that calls a script keeps a silent manual fallback for when python3 is unavailable.
How to locate and invoke the scripts, and which one does what:
skills/shared/scripts.md
Prefer the fast path (run the script, use its JSON) over re-deriving the same facts by hand. Never restate a script's algorithm in prose — the script is the single source of truth so the two cannot drift.
For any document creation or edit, apply:
skills/shared/doc-first.md
Minimum pre-write checklist:
docs/, specs/, design/, architecture/, ideas/, and the project root.The chain has one mandatory spine — a delivery-grade requirements specification, then a technical design — with everything else conditional on what the project actually needs. When the user asks for /spec-forge <name> or "run the full spec-forge chain", execute this sequence:
skills/idea/SKILL.md.ideas/{name}/draft.md.skills/decompose/SKILL.md.docs/project-{name}.md with a first-line FEATURE_MANIFEST block.skills/prd-generation/SKILL.md.docs/{name}/prd.md — business case and product definition.skills/srs-generation/SKILL.md.docs/{name}/srs.md with FR-*/NFR-* requirements, input field rules, state machines, permission matrix, error catalogue, acceptance criteria, and change control.docs/{name}/prd.md exists, trace every capability into requirements. If only ideas/{name}/draft.md exists, derive scope and requirements from it. If neither exists, work from the user's request and state the assumptions explicitly.skills/tech-design-generation/SKILL.md.docs/{name}/tech-design.md.docs/features/ per component in §8.1, plus docs/features/overview.md with the dependency graph and execution order.FR-*/NFR-* requirements it satisfies, and every requirement must be satisfied by at least one component.skills/review/SKILL.md.docs/features/*.md./code-forge:plan @docs/features/ when feature specs were generated./code-forge:plan @docs/{name}/tech-design.md for a single-component design.code-forge:tdd — spec-forge does not produce a separate test document in the chain.Test cases, audit, analyze, and propagate are on-demand outputs, not stages in the default chain.
Read skills/idea/SKILL.md.
Use for early exploration, demand validation, competitive research, and anti-pseudo-requirement checks. Output lives in top-level ideas/{idea-name}/, not under docs/.
Read skills/decompose/SKILL.md.
Use for deciding whether a project is one feature or several independently specifiable sub-features. If multi-split, generate docs/project-{name}.md.
Read skills/prd-generation/SKILL.md.
Answers "is this worth building, for whom, and at what priority". Market context, competitive landscape, demand validation, feasibility go/no-go, personas, user stories, capability scope, success metrics, milestones, risks. Read by stakeholders before commitment and largely frozen once the decision is made. Optional: skip it when the decision to build is already settled.
Deliberately not in the PRD: field-level rules, state machines, error codes, Given/When/Then acceptance criteria, solution architecture. Those are the SRS's and tech design's job. A PRD row that needs more than two sentences is a system behavior in the wrong document.
Read skills/srs-generation/SKILL.md.
Answers "exactly what must be built, and how do we settle whether it was". This is the document an implementation team — an external vendor, another team, or code-forge — is held to, and the mandatory spine of the chain. Formal FR-*/NFR-* requirements with main/alternative flows, input field rules, state machines including illegal-transition handling, permission matrix, error catalogue with degradation behavior, machine-verifiable acceptance criteria, interface and data requirements, traceability, and acceptance and change control.
Unlike the PRD, it keeps evolving through delivery — which is exactly why the two are separate files. A requirement change must not require touching market sizing, and internal go/no-go reasoning must not ship to an implementation vendor.
Read skills/tech-design-generation/SKILL.md.
Use for architecture/design docs, RFCs, API design, data model design, deployment, observability, security, performance, alternatives, and generated feature specs.
Read skills/test-cases-generation/SKILL.md.
Use for test case generation, coverage matrices, test strategy, testable unit extraction, and code/spec-driven QA planning. Honor --formal when requested.
Read skills/review/SKILL.md.
Use after spec generation to check completeness, specificity, internal consistency, traceability, and actionability. Findings first; fixes only where allowed.
Read skills/audit/SKILL.md.
Use when auditing one project that has docs and code. It checks documentation quality, completeness, consistency, staleness, and alignment with the codebase.
Read skills/analyze/SKILL.md.
Use for docs-only or cross-repo document landscapes. It maps themes, conflicts, gaps, redundancies, and stale areas without assuming a single codebase.
Read skills/propagate/SKILL.md.
Use after upstream document changes. It finds downstream docs affected by changed concepts and updates them surgically or reports unresolved stale references.
Default locations:
ideas/{name}/docs/{name}/prd.mddocs/{name}/srs.mddocs/{name}/tech-design.mddocs/features/*.mddocs/{name}/test-cases.md or the path specified by the child skilldocs/project-{name}.md{target-docs-path}/audit-report.md{target-root}/analysis-report.mdIf existing project conventions differ, follow the existing convention and state the location you used.
Before finishing a spec-forge task:
/code-forge:plan handoff command.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.