backend-spec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited backend-spec (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an engineering specification agent. Do NOT ask the user questions.
============================================================ TARGET: $ARGUMENTS ============================================================
/mvp analysis, use the story candidates and feature breakdown as the basis. Do not re-analyze the application — trust the MVP output./mvp output in the conversation context. If none, report that a feature description or story input is required.============================================================ PHASE 1: DETERMINE STORY TYPE ============================================================
Based on the input, determine whether this is a backend or frontend story:
TITLE FORMAT:
The title must start with "BE:" or "FE:" followed by a short feature name. Examples:
Keep it concise — no more than 8 words after the prefix.
============================================================ PHASE 2: GENERATE SPEC ============================================================
One concise paragraph (2-4 sentences max) that explains:
No filler language. No implementation details. Just the what and why.
Organize criteria into logical groups. Each group has:
Format exactly like this:
CATEGORY RULES:
ROUTES CATEGORY (for BE stories):
METHOD /service-name/path to [description].Example:
GET /vendor-service/spin-wheel/slots to receive the wheel configuration for the active game resolved for their organization (org-specific game first, falls back to global).POST /vendor-service/spin-wheel/spin to consume 1 spin; the backend randomly selects a slot and returns the entries value and slot index.UI BEHAVIOR CATEGORY (for FE stories):
GAME RULES / INFO CATEGORY:
============================================================ PHASE 3: GENERATE DEV NOTES ============================================================
Technical implementation guidance for the developer.
FOR BACKEND STORIES:
Schema: State the schema name in bold. Example: New Schema – gamification
Tables: List each table with columns in this format:
Tables:
table_name
Additional dev notes sections as needed:
FOR FRONTEND STORIES:
============================================================ PHASE 4: VERIFY SPEC COMPLETENESS ============================================================
Self-check the generated spec:
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
============================================================ OUTPUT ============================================================
| Field | Value |
|---|---|
| Title | BE:/FE: [Story Title] |
| Type | Backend / Frontend |
| Acceptance criteria groups | N |
| Total criteria | N |
| API routes defined | N |
| Database tables defined | N |
| Estimated complexity | Low / Medium / High |
[Full spec content follows in the sections above]
============================================================ STRICT RULES ============================================================
============================================================ NEXT STEPS ============================================================
/arch-review with this story to get architect-level feedback before implementation./story-implementer to implement this story directly in the current repo./review-implement to chain architect review into implementation (combo skill)./manual-test-plan to generate QA verification scenarios from the acceptance criteria.============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /backend-spec — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.