spec-planner — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-planner (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transforms specifications into a validated spec-graph plan. The graph — not markdown — is the source of truth. This skill enforces a strict procedure; follow each step in order.
STOP. Before proceeding with this skill, you MUST load the `spec-graph` skill.
The spec-graph skill provides the schema knowledge required to operate spec-graph correctly:
mitigates, has_criterion, covers, belongs_to, etc.)(from_type, to_type, relation_type) combinations are allowedWithout `spec-graph` skill loaded, you will hit `INVALID_INPUT` and `INVALID_EDGE` errors and waste tokens guessing at the schema. This is non-negotiable.
To load it, invoke the skill tool with name="spec-graph" before continuing.
spec-graph CLI installed and available in PATH.spec-graph/ will live (or already exists)covers.validate after every batch of mutations.Do not proceed until sufficient information is collected.
Minimum requirements:
If input is a spec document, read it fully before proceeding.
If input is natural language and lacks the above, ask targeted questions:
I need a few more details before creating the plan:
1. [specific missing info]
2. [specific missing info]
What's the scope boundary — what is explicitly OUT of scope?Do not ask more than 3 questions at once. Iterate if needed.
Extract from the input:
Additionally, if the input explicitly mentions:
Rule: Only register what is explicit in the input. Never infer entities that aren't stated.
# Check if .spec-graph/ exists
ls .spec-graph/ 2>/dev/null
# If not, initialize
spec-graph initIf .spec-graph/ already exists, check for active plans:
spec-graph entity list --type plan --status activeIf an active plan exists, inform the user:
An active plan already exists: PLN-XXX "[title]"
Creating a new plan requires archiving the existing one. Proceed?Wait for user confirmation. On confirmation:
spec-graph entity update PLN-XXX --status deprecatedRegister extracted entities. Query before creating to avoid duplicates.
Note:--idis now optional for single creates (auto-generated, capture from.entity.id). However, this batch planning workflow uses explicit--idso that IDs can be cross-referenced in subsequentrelation addcommands within the same pass. Keep explicit IDs here.
# Check existing
spec-graph entity list --type requirement --layer arch
# Register requirements
spec-graph entity add --type requirement --id REQ-001 \
--title "..." \
--description "..." \
--metadata '{"priority":"must","kind":"functional"}'
# Register decisions
spec-graph entity add --type decision --id DEC-001 \
--title "..." \
--metadata '{"rationale":"...","date":"YYYY-MM-DD"}'
# Register acceptance criteria and link to requirements
spec-graph entity add --type criterion --id ACT-001 \
--title "..." \
--metadata '{"given":"...","when":"...","then":"..."}'
spec-graph relation add --from REQ-001 --to ACT-001 --type has_criterion
# Register risks
spec-graph entity add --type risk --id RSK-001 \
--title "..." \
--metadata '{"likelihood":"medium","impact":"high"}'
# Register arch-internal relations
spec-graph relation add --from REQ-001 --to DEC-001 --type constrained_by
spec-graph relation add --from REQ-002 --to REQ-001 --type depends_onDetermine phase count based on project scale:
| Scale | Signals | Phases |
|---|---|---|
| Small | 1-2 modules, <10 endpoints | 2-4 |
| Medium | Multiple modules, auth/DB, 3-5 integrations | 4-7 |
| Large | Multi-service, CI/CD, monitoring | 6-12 |
# Create plan (--status active is required for phase next to work)
spec-graph entity add --type plan --id PLN-001 \
--title "..." \
--status active
# Create phases (all as draft)
spec-graph entity add --type phase --id PHS-001 \
--title "Phase 1 - ..." \
--metadata '{"goal":"...","order":1,"exit_criteria":["criterion 1","criterion 2"]}'
spec-graph entity add --type phase --id PHS-002 \
--title "Phase 2 - ..." \
--metadata '{"goal":"...","order":2,"exit_criteria":["criterion 1","criterion 2"]}'PHS ID = execution order: The numeric suffix of PHS IDs determines execution sequence. PHS-001 is always first, PHS-002 always second. Do NOT assign IDs out of order (e.g., PHS-003 before PHS-001). If you reorder phases, renumber the IDs to match.
Rules for exit_criteria:
Phase buildability constraint: When decomposing work into phases, ensure each phase's scope is self-contained enough that the project remains buildable/runnable after completion. If a feature requires multiple phases to become buildable, use techniques like:
# Assign phases to plan
spec-graph relation add --from PHS-001 --to PLN-001 --type belongs_to
spec-graph relation add --from PHS-002 --to PLN-001 --type belongs_to
# Set ordering
spec-graph relation add --from PHS-001 --to PHS-002 --type precedesParallel-eligible phases: if two phases have no dependency, do NOT add precedes between them.
Map every arch entity to at least one phase:
spec-graph relation add --from PHS-001 --to REQ-001 --type covers
spec-graph relation add --from PHS-001 --to REQ-002 --type covers
spec-graph relation add --from PHS-002 --to REQ-003 --type coversCoverage rule: Every active arch entity (REQ, DEC, ACT, RSK, and any registered API/STT/TST) must be covered by at least one phase. No orphaned arch entities.
Run full 3-layer validation:
spec-graph validate --layer arch
spec-graph validate --layer exec
spec-graph validate --layer mappingIf any check fails:
Do not proceed until all three layers pass.
Check for persistent instructions files in project root:
ls AGENTS.md CLAUDE.md .cursorrules .github/copilot-instructions.md 2>/dev/nullIf found: Check if spec-graph section already exists. If not, append:
## spec-graph
This project uses spec-graph for requirements and phase management.
- `.spec-graph/` directory is the source of truth
- Before implementation: `spec-graph query scope <PHS-ID>` to check phase scope
- After implementation: `spec-graph validate` to verify
- Before changes: `spec-graph impact <ID>` for impact analysis
- Phase lifecycle: draft → active → resolvedIf not found: Inform the user:
No persistent instructions file found (AGENTS.md, CLAUDE.md, etc.).
For other agents to recognize spec-graph in this project, creating one is recommended.
Create AGENTS.md with spec-graph instructions?Act on user response.
| Exit Code | Meaning | Action |
|---|---|---|
| 0 | Success | Proceed |
| 1 | Runtime error | Check stderr, retry |
| 2 | Validation failure | Parse output, fix, re-validate |
| 3 | Invalid input | Check arguments/schema, fix, retry |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.