Skip to content
Back to skills

Speckit Analyze

ASecurity

User input (consider it if not empty): $ARGUMENTS **Read-only**: change no files. The constitution (`.specify/memory/constitution.md`) is non-negotiable: a conflict with it is always CRITICAL and is fixed in spec, plan or tasks, never by reinterpreting the principle.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 25, 2026
ai-agentsgobashsecurityperformance

Security analysis

A100/100

Scanned September 25, 2026

npx -y skills add rayedbajwa/spaces --skill speckit-analyze --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Speckit Analyze?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Speckit Analyze
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/rayedbajwa-speckit-analyze/badge)](https://www.skillsdirectory.com/skills/rayedbajwa-speckit-analyze)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Analyze: check spec, plan and tasks against each other

User input (consider it if not empty): $ARGUMENTS

**Read-only**: change no files. The constitution (`.specify/memory/constitution.md`) is non-negotiable: a conflict with it is always CRITICAL and is fixed in spec, plan or tasks, never by reinterpreting the principle.

## Steps

1. Run `.specify/scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks`; use `FEATURE_DIR`. If spec.md, plan.md or tasks.md is missing, say which stage to run and stop.
2. Read only what the analysis needs: the spec's requirements, stories and edge cases; the plan's stack, data model, phases and constraints; the task IDs, descriptions, phases, `[P]` markers and paths; the constitution's MUST/SHOULD rules.
3. Build (internally) a requirements inventory with stable keys, and map each task to the requirements and stories it serves.
4. Find, at most 50 findings (summarize the overflow):
   - **Duplication**: near-duplicate requirements.
   - **Ambiguity**: vague adjectives without a measure; unresolved placeholders (TODO, ???, `<…>`).
   - **Underspecification**: requirements without a measurable outcome; stories without acceptance criteria; tasks naming files or components absent from spec/plan.
   - **Constitution**: conflicts with a MUST; missing mandated sections or gates.
   - **Coverage**: requirements with no task; tasks with no requirement; non-functional requirements with no task.
   - **Inconsistency**: terminology drift; entities in one document but not the other; task order contradictions; conflicting requirements.
5. Severity: **CRITICAL** constitution MUST violation, missing core artifact, or a blocking requirement with no coverage · **HIGH** duplicate/conflicting requirement, ambiguous security or performance attribute, untestable criterion · **MEDIUM** terminology drift, missing non-functional coverage, underspecified edge case · **LOW** wording.
6. Output the report:

   ```markdown
   ## Specification Analysis Report
   | ID | Category | Severity | Location(s) | Summary | Recommendation |
   |----|----------|----------|-------------|---------|----------------|

   **Coverage**: | Requirement | Has task? | Task IDs | Notes |
   **Constitution issues** · **Unmapped tasks** (if any)
   **Metrics**: requirements, tasks, coverage %, ambiguities, duplications, critical issues
   ```

   IDs are stable and prefixed by category (A1, D2…). With no issues, report the coverage statistics.
7. **Next actions**: resolve CRITICAL issues before implementing; otherwise proceeding is fine, with the improvements named. Offer concrete remediation edits for the top issues, and do not apply them.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.