spec-first — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-first (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Decide what and why on paper before writing how in code. A spec is a cheap place to be wrong — changing a paragraph costs minutes; changing shipped code costs days. A good spec is short, testable, and disagreed-with early — not a design doc that pretends every question is answered.
Define phase chain: [[idea-shaping]] (worth building?) → [[product-brief]] (stakeholder alignment, when needed) → spec-first (engineering spec) → [[work-planning]] (tasks) → [[incremental-delivery]] + [[test-first]] (build). Record significant choices in [[decision-docs]].
Pair with [[interface-design]] when the spec defines API boundaries, [[design-handoff]] when UI behavior is specified, [[migration-path]] when the change breaks callers, and [[source-first]] when the spec must reflect how the system works today.
Skip for genuinely trivial edits — typo, copy tweak, one-line fix with obvious behavior. Skip when [[idea-shaping]] hasn't confirmed pursue on a fuzzy initiative — shape first, don't spec a maybe.
Not a substitute for [[product-brief]] — cross-team PRD/RFC sign-off lives there; spec-first is the engineering implementation spec engineers build and test against.
| Situation | Use |
|---|---|
| Fuzzy one-liner, worth unknown | [[idea-shaping]] first |
| Multi-stakeholder PRD / platform RFC | [[product-brief]] → then spec-first |
| One team, clear problem, ready to build | spec-first |
| Locked PRD approved | spec-first (derive testable requirements) |
Work in order. Stop and ask when the goal isn't one sharp sentence.
Before writing requirements:
([[product-brief]])
If any fail, step back — specifying an unshaped idea produces fiction.
If you cannot, you don't understand the request yet — ask.
Good: "Logged-in sellers can duplicate an existing listing as a draft in one click."
Bad: "Improve the listing experience."The sentence is the north star — every requirement should trace to it.
Even in an engineering spec, one short problem paragraph prevents solution-only specs:
Don't re-run full [[idea-shaping]] — three sentences max unless the brief already covers it.
List concrete scenarios (user or system), not feature bullet soup:
1. Seller clicks "Duplicate" on published listing → draft created with copied fields → lands on edit screen
2. Seller duplicates while at listing limit → clear error, no partial draft
3. Guest hits duplicate URL → redirect to login with return pathEach scenario becomes a test candidate ([[test-first]]). Cover:
Requirements are observable statements someone can verify — not adjectives.
Bad: "The page should be fast and intuitive."
Good: "Search results render within 2s p95 on 4G for 20-item result set ([[perf-budget]])."
Good: "Keyboard users can complete checkout without a mouse ([[accessibility]])."
Good: "A logged-out user hitting /dashboard is redirected to /login?returnUrl=…"Structure:
| ID | Requirement | Priority |
|---|---|---|
| R1 | … | Must |
| R2 | … | Must |
| R3 | … | Nice |
Must = ship blocker. Nice = explicitly deferrable without renegotiating success.
Use Given / When / Then for complex rules when plain prose gets ambiguous.
Scope creep starts with unstated assumptions. List what this change does not do:
Out of scope:
- Bulk duplicate (single listing only in v1)
- Copying analytics/history to the new listing
- Mobile native app (web responsive only)If stakeholders might expect it, say no here — not silence.
Don't boilerplate everything — call out NFRs that change design:
| Area | Example in spec | Skill if deep |
|---|---|---|
| Security | "Only listing owner or admin can duplicate" | [[hardening]] |
| Performance | "Duplicate API p95 < 500ms" | [[perf-budget]] |
| Accessibility | "Duplicate action keyboard-accessible, announced to SR" | [[accessibility]] |
| Observability | "Emit listing.duplicated event with source id" | [[observability]] |
| Compatibility | "Existing listing URLs unchanged" | [[migration-path]] |
One line each unless the feature is the NFR (e.g. audit log).
Enough for [[work-planning]] and review — not an implementation manual:
Approach sketch:
- POST /listings/:id/duplicate → new draft row, copy scalar fields, async copy images
- Reuse ListingDraftEditor; add Duplicate button on ListingDetail (owner only)
- Flag: listings.duplicate_enabled (default off in prod until launch)Flag spikes for unknowns ("image copy latency unknown — spike in day 1").
Edge cases — answer in spec when cheap; defer with owner when not:
- Source listing deleted mid-duplicate → 404, no orphan draft
- Source is already a draft → allow duplicate? YES (copy draft as new draft)Open questions — table with owner and resolution date:
| Question | Owner | By when |
|---|---|---|
| Copy scheduled publish date? | PM | Before build |
| Max duplicates per day? | — | Default: no limit v1 |
Unresolved must-haves block [[work-planning]] — nice-to-haves can defer.
Risks — what could make this wrong or late; mitigations in one line.
"Done" is not "code merged." It's observable conditions:
Done when:
- [ ] R1–R5 pass in staging
- [ ] Duplicate flow verified in browser ([[browser-checks]])
- [ ] Migration applied; rollback steps documented ([[launch-readiness]])
- [ ] Analytics event visible in dashboard
- [ ] Feature flag off by default; runbook for enableTie back to requirement IDs. This becomes the review checklist for [[review-gate]].
After approval → [[work-planning]] to decompose, then [[incremental-delivery]].
Specs go stale when decisions change silently:
# [Feature] — Spec
Status: Draft | Review | Approved
Author: … | Reviewers: …
## Goal (one sentence)
…
## Problem & context
…
## Scenarios
1. …
2. …
## Requirements
| ID | Requirement | Priority |
|----|-------------|----------|
| R1 | … | Must |
## Out of scope
- …
## Non-functional (if any)
- …
## Approach sketch
- …
## Edge cases & errors
- …
## Open questions
| Question | Owner | By |
## Risks
- …
## Done when
- [ ] …~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.