Spec Coder

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:43 AM UTC
• Version: 0.1.4

Overview

The skill is a transparent spec-first coding workflow; it can modify project files and auto-advance some review gates, but I found no hidden, deceptive, exfiltrating, or system-persistent behavior.

Install this if you want a structured spec-first coding process that can maintain project specs, generate or modify code and tests, run local verification commands, and make task-level commits. Set review preferences to require manual approval if you do not want gates to auto-advance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The workflow allows review gates to be automatically approved when no Critical/Major issues are detected. In a code/spec generation skill, that reduces required human oversight and can let flawed or risky outputs progress if the gate logic misses subtle security, privacy, or correctness problems. The danger is amplified because later phases include code generation and verification actions that may be taken based on these approvals.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

on change scope

text

Gates auto-approve when no Critical/Major issues. See [Expert Review Protocol](references/expert-review-protocol.md) for details.

### Quick Reference

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This explicitly permits Gate 1 to exit via auto-approval rather than user approval. Requirements are security-relevant; if they are incomplete or ambiguous, downstream specs and generated code can embed unsafe assumptions without a human catching them early.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

### → Gate 1: Requirements Review

Per [Expert Review Protocol — Gate 1](references/expert-review-protocol.md#gate-1-requirements-review-after-phase-1). **Exit:** User approves (or auto-approved).

## Phase 2: Spec

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Auto-approving design review weakens scrutiny over architecture, interfaces, and data flows. In this skill, design artifacts directly drive implementation, so a missed issue at this stage can propagate into generated code and tests and become harder to detect later.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

### → Gate 2: Design Review (2a + 2b combined)

Per [Expert Review Protocol — Gate 2](references/expert-review-protocol.md#gate-2-design-review-after-phase-2a--2b-combined). **Exit:** User approves (or auto-approved).

### 2c: Task Breakdown → `specs/tasks.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Allowing the implementation plan review to auto-approve means tasks and feature specs can advance without a human confirming that the plan is safe, complete, and aligned with intent. Because Phase 3 executes against these artifacts, unsafe or incomplete tasking can directly influence generated code paths and test coverage.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

### → Gate 3: Implementation Plan Review (2c + 2d combined)

Per [Expert Review Protocol — Gate 3](references/expert-review-protocol.md#gate-3-implementation-plan-review-after-phase-2c--2d-combined). **Exit:** User approves (or auto-approved).

### Spec Quality Checklist

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Auto-approval at code review is the most concerning instance because it can allow generated code to proceed to verification or use without mandatory human inspection. Automated reviewers may miss subtle vulnerabilities, insecure defaults, prompt-injection side effects, or business-logic flaws, especially in a tool designed to generate and modify code autonomously.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

### → Gate 4: Code Review

Per [Expert Review Protocol — Gate 4](references/expert-review-protocol.md#gate-4-code-review-after-phase-3). **Exit:** User approves (or auto-approved). Proceed to Phase 4.

## Phase 4: Verify

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The cross-phase guidance normalizes auto-approval as part of the expert review protocol, making reduced oversight systemic rather than incidental. Because this skill spans requirements through code generation and verification, a systemic auto-approval model increases the chance that unsafe outputs can move through multiple phases unchecked.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

- **Spec-code traceability:** Every code change traces to a spec item (TASK-ID + TP-ID); every spec item has corresponding code and tests.
- **Status tracking:** Maintain `specs/status.md` (see [template](references/templates-lifecycle.md#statusmd-template)). Update at each phase end with current phase, gate results, and deferred item counts. On session start, read `specs/status.md` first to restore context.
- **Context management:** Keep each spec file under ~300 lines. In Phase 3, feed only the relevant `spec_xxx.md` + related `design.md` sections — not all spec files at once.
- **Expert review:** All review gates follow the [Expert Review Protocol](references/expert-review-protocol.md). Key points: auto-approve when no Critical/Major issues; max 3 rounds per gate; track prior issues across rounds; deferred items logged in spec files. Users can set review preferences in `specs/status.md`.
- **UI de-AI aesthetic:** All user-facing UI must follow the [UI Design Guidelines](references/ui-design-guidelines.md) to avoid AI-template aesthetics. Gate 2 and Gate 4 reviewers check UI against the de-AI checklist.

## Error Recovery

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md

| **SPEC-GAP: Cannot decide autonomously** | Tag as `[SPEC-GAP-BLOCKED]`, implement a safe no-op or error response as placeholder, and batch all blocked gaps for user decision before Phase 4 verification. |
| **Phase 5: Delta merge conflict** | Follow conflict handling in [spec-lifecycle.md](references/spec-lifecycle.md#conflict-handling). Never force-overwrite trunk — always present both versions to the user. |
| **Cross-session context loss** | Read `specs/status.md` + last completed artifacts (see Session Start). If status.md is missing or stale, scan `specs/` directory structure and `tasks.md` status to reconstruct state. |
| **Phase 1: Requirements deadlock** | If the user cannot decide after 3 clarification rounds, present a default recommendation with rationale. Ask for explicit approval or override. Do not loop indefinitely. |
| **Phase 2: Design deadlock** | If two design options are equally viable, document both in ADR format (pros/cons/consequences), provide a recommended option, and ask the user to decide. Limit to 2 discussion rounds, then adopt the recommendation if no response. |

## Templates

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/expert-review-protocol.md (reported line 17)May include surrounding context.

md

| **Medium** | Standard | 2–3 roles per gate. |
| **Large** | Full | All listed roles per gate. |

### Auto-Approve Rule

If the review finds **zero Critical and zero Major** issues, present a summary and auto-approve:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/expert-review-protocol.md (reported line 19)May include surrounding context.

md

### Auto-Approve Rule

If the review finds **zero Critical and zero Major** issues, present a summary and auto-approve:

> "Expert review complete — no Critical or Major issues found. [N Minor suggestions listed below.] Proceeding to next phase. Reply 'hold' to pause and address Minor items first."

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Although framed as a user preference, 'all gates auto-approve regardless of severity' effectively disables the control function of expert review. Because this skill governs requirements, design, implementation planning, and code review, bypassing all gates can let severe auth, validation, or secret-handling problems pass unchecked into generated artifacts.

Content

Scanner excerpt · references/expert-review-protocol.md (reported line 95)May include surrounding context.

md

- `"Skip UX reviews"` — UX/UI Designer role is omitted from Gate 2.
- `"Focus on security"` — Security Expert role is always included, even on Small track.
- `"Auto-approve all gates"` — all gates auto-approve regardless of severity (user takes full responsibility).
- `"Only flag Critical"` — Major and Minor issues are listed but don't require user response.

If no preferences are set, use the default behavior (track-based depth, standard severity rules).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Although framed as a user preference, 'all gates auto-approve regardless of severity' effectively disables the control function of expert review. Because this skill governs requirements, design, implementation planning, and code review, bypassing all gates can let severe auth, validation, or secret-handling problems pass unchecked into generated artifacts.

Content

Scanner excerpt · references/expert-review-protocol.md (reported line 95)May include surrounding context.

md

- `"Skip UX reviews"` — UX/UI Designer role is omitted from Gate 2.
- `"Focus on security"` — Security Expert role is always included, even on Small track.
- `"Auto-approve all gates"` — all gates auto-approve regardless of severity (user takes full responsibility).
- `"Only flag Critical"` — Major and Minor issues are listed but don't require user response.

If no preferences are set, use the default behavior (track-based depth, standard severity rules).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The template explicitly includes an 'Auto-approved' verdict option for expert review output, which can enable the agent to make approval decisions without explicit user confirmation. In a spec-first coding workflow with review gates, this increases the chance that flawed requirements, unsafe designs, or risky code changes are advanced automatically without sufficient human oversight.

Content

Scanner excerpt · references/templates-lifecycle.md (reported line 233)May include surrounding context.

Suggested fix order: #1 (Major, blocks #2) → #2 (Major) → #3 (Minor, optional)

Verdict: [Auto-approved ✅ / Needs user decision ⚠️]

text

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The guideline mandates specific English wording patterns such as avoiding terms like "Intelligent" and preferring English task-oriented verbs like "Track orders" and "Review pull requests." This imposes a language-specific copy policy without any indication that localization or user/project language choice is allowed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.