Check Impl Against Spec Skill Security Audit
What the author says it does (original text)
Compare a pull request's implementation against spec context in spec_context.md and feed any material mismatches into review.json. Use during PR review when approved or repository spec context is available.
No obvious risks found in this check
- Files checked
- 1
- Risks found
- 0
Inside this skill
This Skill is used only during PR review when `spec_context.md` exists; it compares product and technical-spec commitments from that file with the PR diff and checked-out files.
View source
Use this skill only when `spec_context.md` exists during PR review.- `spec_context.md` contains the spec context to compare against. It may include both product spec content (intended behavior, acceptance criteria) and tech spec content (implementation details, file changes).- `pr_diff.txt` contains the annotated diff for the PR.- `pr_description.md` may contain additional scope or rationale.- The working tree contains the PR branch contents.1. Read `spec_context.md` and extract the concrete commitments it makes: - required behaviors (from the product spec) - required files or subsystems to change (from the tech spec) - stated constraints - required follow-up steps, validation, or migrations2. Compare those commitments against the actual implementation in `pr_diff.txt` and the checked-out files.3. Treat small implementation-level adjustments as acceptable when they preserve the spec's intent. Do not flag harmless differences in naming, structure, or low-level technique.Results are folded into the existing `review.json` rather than a separate report; inline comments are limited to issues tied to changed diff lines, and direct posting to GitHub is explicitly prohibited.
View source
- Do not create a separate report file.- Fold spec-alignment findings into `review.json`.- Put broad spec-drift concerns in the review summary.- Add inline comments only when the mismatch can be tied to changed lines in the diff.- Treat material spec drift as at least an important concern.- If the implementation matches the spec closely enough, do not add comments just to mention alignment.- Do not speculate about spec details that are not actually present in `spec_context.md`.- Do not post to GitHub directly.The Skill calls for reporting only material divergence and accepts different naming, structure, or low-level implementation techniques when they safely preserve the specification's intent.
View source
2. Compare those commitments against the actual implementation in `pr_diff.txt` and the checked-out files.3. Treat small implementation-level adjustments as acceptable when they preserve the spec's intent. Do not flag harmless differences in naming, structure, or low-level technique.4. Flag a mismatch only when it is material, such as: - required behavior in the product spec is missing - the implementation contradicts a spec decision - the change introduces significant unplanned scope - a required validation, migration, or compatibility step from the tech spec is absent- Do not require literal one-to-one implementation of the spec when the PR achieves the same outcome safely.- Do not speculate about spec details that are not actually present in `spec_context.md`.- Do not post to GitHub directly.Files and check records1 files
Coverage and gaps
Content covered in each file
These are the source ranges included in this check, not a guarantee that every issue has been resolved.
SKILL.mdFull text included
This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.
SKILL.mdInstructions
- Lines read
- 50
- File checksum (to compare versions)
- 6c85d04e4bf110ad03cd209a5f9a3c6900a33fbea4c1a7cb0453a950e8c86d3d