Generate industry-standard specifications — PRD, SRS, Technical Design, and Test Plan — each usable standalone or as part of a full traceability chain
SaferSkills independently audited spec-forge (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Spec-forge is a documentation and specification workflow suite. This root skill is the Codex-facing orchestrator: decide which child skill to load, keep the document chain coherent, and avoid loading large generation references until they are needed.
Use this skill when the user asks for any of the following:
skills/idea/SKILL.mdskills/decompose/SKILL.mdskills/prd-generation/SKILL.mdskills/srs-generation/SKILL.mdskills/tech-design-generation/SKILL.mdskills/test-cases-generation/SKILL.mdskills/review/SKILL.mdskills/audit/SKILL.mdskills/analyze/SKILL.mdskills/propagate/SKILL.mdidea -> decompose -> tech-design -> reviewAlso treat slash-like requests as aliases:
| User request | Route |
|---|---|
/spec-forge <name> | Full chain |
/spec-forge:idea <name> or /idea <name> | Idea |
/spec-forge:decompose <name> or /decompose <name> | Decompose |
/spec-forge:tech-design <name> or /tech-design <name> | Tech Design |
/spec-forge:prd <name> or /prd <name> | PRD |
/spec-forge:srs <name> or /srs <name> | SRS |
/spec-forge:test-cases <target> or /test-cases <target> | Test Cases |
/spec-forge:review <name> or /review <name> | Review |
/spec-forge:audit [path] or /audit [path] | Audit |
/spec-forge:analyze [path] or /analyze [path] | Analyze |
/spec-forge:propagate ... or /propagate ... | Propagate |
The commands/*.md files are compatibility command definitions from the original Claude-oriented implementation. In Codex, prefer reading the child skills/*/SKILL.md files directly. Use commands/spec-forge.md only as an additional orchestration reference if you need more detail about the full chain.
Keep context small.
SKILL.md matching the user's request.skills/shared/project-context.md, read it if the workflow needs code/project awareness.skills/shared/doc-first.md, apply it before generating or editing docs.Do not bulk-load every child skill. Do not read every reference folder just because the suite is complex.
prd-v2.md, new-tech-design.md, or addendum files. Edit the canonical file in place unless no canonical document exists.For generation workflows that need grounding in the actual codebase, use:
skills/shared/project-context.md
Apply it before PRD, SRS, tech-design, decompose, and test-cases work when the project exists. It produces a concise summary of:
For the full chain, scan project context once and reuse the summary across stages instead of repeatedly rescanning the same repository.
For any document creation or edit, apply:
skills/shared/doc-first.md
Minimum pre-write checklist:
docs/, specs/, design/, architecture/, ideas/, and the project root.When the user asks for /spec-forge <name> or "run the full spec-forge chain", execute this sequence:
skills/idea/SKILL.md.ideas/{name}/draft.md.skills/decompose/SKILL.md.docs/project-{name}.md with a first-line FEATURE_MANIFEST block.skills/tech-design-generation/SKILL.md.docs/{name}/tech-design.md.docs/features/.ideas/{name}/draft.md exists, use it for user scenarios, acceptance criteria, success metrics, scope, and goals.skills/review/SKILL.md.docs/features/*.md.PRD, SRS, and test cases are optional on-demand outputs, not required stages in the default full chain.
Read skills/idea/SKILL.md.
Use for early exploration, demand validation, competitive research, and anti-pseudo-requirement checks. Output lives in top-level ideas/{idea-name}/, not under docs/.
Read skills/decompose/SKILL.md.
Use for deciding whether a project is one feature or several independently specifiable sub-features. If multi-split, generate docs/project-{name}.md.
Read skills/prd-generation/SKILL.md.
Use for product requirements, stakeholder alignment, product strategy, market context, personas, user stories, priorities, success metrics, and timelines.
Read skills/srs-generation/SKILL.md.
Use for formal functional/non-functional requirements, requirement IDs, interfaces, data requirements, acceptance criteria, and traceability matrices.
Read skills/tech-design-generation/SKILL.md.
Use for architecture/design docs, RFCs, API design, data model design, deployment, observability, security, performance, alternatives, and generated feature specs.
Read skills/test-cases-generation/SKILL.md.
Use for test case generation, coverage matrices, test strategy, testable unit extraction, and code/spec-driven QA planning. Honor --formal when requested.
Read skills/review/SKILL.md.
Use after spec generation to check completeness, specificity, internal consistency, traceability, and actionability. Findings first; fixes only where allowed.
Read skills/audit/SKILL.md.
Use when auditing one project that has docs and code. It checks documentation quality, completeness, consistency, staleness, and alignment with the codebase.
Read skills/analyze/SKILL.md.
Use for docs-only or cross-repo document landscapes. It maps themes, conflicts, gaps, redundancies, and stale areas without assuming a single codebase.
Read skills/propagate/SKILL.md.
Use after upstream document changes. It finds downstream docs affected by changed concepts and updates them surgically or reports unresolved stale references.
Default locations:
ideas/{name}/docs/{name}/prd.mddocs/{name}/srs.mddocs/{name}/tech-design.mddocs/features/*.mddocs/{name}/test-cases.md or the path specified by the child skilldocs/project-{name}.md{target-docs-path}/audit-report.md{target-root}/analysis-report.mdIf existing project conventions differ, follow the existing convention and state the location you used.
Before finishing a spec-forge task:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.