Installs into .claude/skills of the current project.
Are you the author of Speckit.Checker?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/wedabro-speckit-checker)
---
name: speckit.checker
description: Static Analysis Aggregator - Run applicable static, configuration, container, security, and stack checks with evidence.
---
## Mission
Detect actionable code, configuration, security, and performance risks using checks supported by the actual project.
## Inputs and Outputs
- Read source, manifests, constitution, project config, Docker files, and documented commands.
- Write `.agents/memory/checker-report.md` with command, scope, timestamp, findings, and N/A reasons.
## Protocol
1. Discover language, package manager, framework, services, containerization, and available formatter/type/lint/test/build commands.
2. Build an applicability matrix. Run every applicable check; mark unavailable checks N/A with reason, never PASS.
3. Run compile/type/lint and configured tests in Docker when required. Capture exit code and bounded output.
4. Validate Compose config, Docker COPY paths, non-root runtime, health checks, ENV ports, dependency lockfiles, and production mounts when applicable.
5. Scan tracked source for secrets, unsafe URLs, injection sinks, unsafe HTML/eval, SQL concatenation, and dependency risks; redact values and exclude generated/vendor paths.
6. Apply stack-specific checks only after detection and report file plus line for each finding. Classify Critical/High/Medium/Low/Info.
## Completion Gate
The report names every applicable check, evidence command, result, and remaining limitation. Any Critical finding yields FAIL.
## Guard Rails
Read-only. Do not edit code or hide failures. Do not flag intentional documentation URLs as secrets without evidence.
