spec-to-code-compliance

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, code-quality, documentation, research.

What it does

Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill spec-to-code-compliance

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/spec-to-code-compliance/skills/spec-to-code-compliance ~/.claude/skills/spec-to-code-compliance

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only: it tells an agent how to compare a specification with code and read/write markdown reports, but it ships no executable code, installers, or networked components. The main risk is process-level: it can drive an agent to read a lot of repository content and produce compliance judgments, but it does not itself touch secrets, system settings, or external services.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No scripts, shell commands, or code-evaluation logic ship with the skill; the files are SKILL.md, markdown resources, a YAML manifest, and an SVG asset.
Network access	0 (none)	There are no download commands, API calls, or remote-host interactions in the shipped files.
Filesystem reach	0 (none)	The skill describes reading repository files and writing reports in its own workspace, with no instructions to access paths outside the project.
Secrets & credentials	0 (none)	It does not ask for tokens, passwords, dotfiles, keychains, or browser sessions, and it never mentions handling credentials.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or shell/OS configuration change in the shipped material.
Instruction hijack surface	0 (none)	The text is instructional for the agent but does not ask it to ignore higher-priority rules, hide actions, or follow remote instructions.
Irreversible actions	0 (none)	It analyzes code-versus-specification only; it does not deploy, publish, delete, pay, message, or mutate external state.
Transparency	0 (none)	All shipped files are human-readable markdown/YAML/SVG; there are no binaries, installers, minified blobs, or decoded-at-runtime payloads.

Before installing

Scan the repo for any additional scripts or executables beyond the files shown here.
Open `SKILL.md` and the `resources/*.md` files to confirm the skill is analysis-only and does not invoke external tools or services.
If you plan to extend it, keep any new automation in reviewed source files rather than hidden/generated artifacts.

Rated 2026-10-20 by an automated review of 7 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/spec-to-code-compliance/skills/spec-to-code-compliance/SKILL.md
Branch: main
Collection: spec-to-code-compliance
Updated: 2026-09-19

audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
variant-analysis — Hunts for the other instances of a bug already found — the variants of one root cause across a codebase.
principle-minimize-reader-load — Apply when reviewing or shaping code that's hard to trace.
recall — Reconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents).
stitch::extract-design-md — Extract a comprehensive design system (DESIGN.md) directly from frontend source code — React, Vue, Svelte, Angular, plain HTML/CSS.
verify-this — Verify a claim with fresh local evidence: restate it falsifiably, capture baseline and treatment, compare artifacts, and return VERIFIED, NOT VERIFIED.