sdd-spec-kit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sdd-spec-kit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use for GitHub Spec Kit, Specify CLI, /speckit.*, $speckit-*, .specify/, extensions, presets, or Spec Kit command behavior.
Project workspace is source of truth. Upstream https://github.com/github/spec-kit and any user-provided Spec Kit reference checkout are references unless the user asks to edit Spec Kit itself.
PowerShell: use $env:PLUGIN_ROOT for $PLUGIN_ROOT command paths.
python3 "$PLUGIN_ROOT/scripts/sdd_surface_audit.py" <repo> --json
git status --shortCheck .specify/, .specify/feature.json, .specify/memory/constitution.md, specs/*/{spec.md,plan.md,tasks.md}, and .specify/extensions.yml. State any init/install/upgrade/fetch before running it.
Follow project command files when present; otherwise use this layout:
.specify/memory/constitution.mdspecs/<feature>/spec.md plus specs/<feature>/checklists/requirements.md[NEEDS CLARIFICATION]plan.md, research.md, data-model.md, contracts/, quickstart.md, risk/evidence profiletasks.md with dependency order, requirement links, paths, verification, expected evidenceFor .specify/extensions.yml: read relevant before_*/after_*; skip disabled hooks; do not evaluate non-empty conditions yourself. Mandatory hooks surface EXECUTE_COMMAND: <command> and wait when supported. Optional hooks are reported unless requested.
spec.md: no implementation leakage unless template allows; sources/assumptions/ambiguity/review gaps visible for high-impact requirements.plan.md: decisions, rationale, alternatives, constitution gate, risk/evidence profile, traceability strategy.tasks.md: IDs, story labels when applicable, paths, dependencies, independent validation.evidence.md, validation.md, proof.md, or equivalent in quickstart.md/tasks.md.python3 "$PLUGIN_ROOT/scripts/sdd_traceability_check.py" <repo> --json before implementation and before claiming done.Return active feature directory, changed Spec Kit artifacts, unresolved risks, validation commands/outcomes, evidence updates, and next phase.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.