Check Impl Against Spec Skill 安全审计

78Use this skill only when `spec_context.md` exists during PR review.9

1516- `spec_context.md` contains the spec context to compare against. It may include both product spec content (intended behavior, acceptance criteria) and tech spec content (implementation details, file changes).17- `pr_diff.txt` contains the annotated diff for the PR.18- `pr_description.md` may contain additional scope or rationale.19- The working tree contains the PR branch contents.20

22231. Read `spec_context.md` and extract the concrete commitments it makes:24   - required behaviors (from the product spec)25   - required files or subsystems to change (from the tech spec)26   - stated constraints27   - required follow-up steps, validation, or migrations282. Compare those commitments against the actual implementation in `pr_diff.txt` and the checked-out files.293. Treat small implementation-level adjustments as acceptable when they preserve the spec's intent. Do not flag harmless differences in naming, structure, or low-level technique.

3738- Do not create a separate report file.39- Fold spec-alignment findings into `review.json`.40- Put broad spec-drift concerns in the review summary.41- Add inline comments only when the mismatch can be tied to changed lines in the diff.42- Treat material spec drift as at least an important concern.43- If the implementation matches the spec closely enough, do not add comments just to mention alignment.44

48- Do not speculate about spec details that are not actually present in `spec_context.md`.49- Do not post to GitHub directly.50

282. Compare those commitments against the actual implementation in `pr_diff.txt` and the checked-out files.293. Treat small implementation-level adjustments as acceptable when they preserve the spec's intent. Do not flag harmless differences in naming, structure, or low-level technique.304. Flag a mismatch only when it is material, such as:31   - required behavior in the product spec is missing32   - the implementation contradicts a spec decision33   - the change introduces significant unplanned scope34   - a required validation, migration, or compatibility step from the tech spec is absent35

4647- Do not require literal one-to-one implementation of the spec when the PR achieves the same outcome safely.48- Do not speculate about spec details that are not actually present in `spec_context.md`.49- Do not post to GitHub directly.