to-spec
An agent skill by mattpocock, from mattpocock/skills. Tags: analysis, documentation, issue-tracking, planning, workflow.
What it does
Turn the current conversation into a spec and publish it to the project issue tracker: no interview, just synthesis of what you've already discussed.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add mattpocock/skills --skill to-specOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/engineering/to-spec ~/.claude/skills/to-specSafety box score
Grade B, low risk: 18 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill reads the repository and turns the current conversation into an issue-tracker spec, then publishes it and applies a triage label. The main risk is not code execution but externalizing conversation-derived project details and making tracker changes automatically.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, code evaluation, or native scripts are shipped in the reviewed files; the skill text only describes reading the repo and writing a spec. |
| Network access | 2 (moderate) | It explicitly says to "publish it to the project issue tracker" and "Apply the `ready-for-agent` triage label," which sends content to a remote service. |
| Filesystem reach | 1 (low) | The process says to "Explore the repo" to understand the codebase, which is read-only project access but still touches local files. |
| Secrets & credentials | 0 (none) | The files do not request passwords, tokens, key files, or other secret material. |
| Privilege & persistence | 0 (none) | There is no sudo, global install, service registration, or shell/OS settings change in the skill files. |
| Instruction hijack surface | 0 (none) | I did not find prompt-injection style instructions such as hiding content, skipping safety checks, or following fetched instructions. |
| Irreversible actions | 2 (moderate) | The skill autonomously creates an issue and applies a label; that is a real external action, though bounded to the issue tracker. |
| Transparency | 0 (none) | The reviewed source is plain markdown/YAML only; there are no binaries, obfuscated blobs, or downloaded installers. |
Before installing
- Confirm the intended issue tracker and label vocabulary match your project before enabling this skill.
- Check whether specs may include sensitive conversation details and redact anything you would not want stored in the tracker.
- Run it once in a scratch project or test tracker account to verify exactly what content gets posted and how labels are applied.
Rated 2026-10-16 by an automated review of 2 files from the skill's repository.
Source
- Repository
- mattpocock/skills (all skills from this repository)
- Path
- skills/engineering/to-spec/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- to-questionnaire — Turn a decision you can't fully answer into a questionnaire for someone else to fill in.
- automate-me — Use for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill".
- figure-it-out — Design an auditable playbook when no narrower one fits: a large migration, an ambitious multi-part change, or work a human reviews after stepping away.
- marketing-plan — When the user needs a comprehensive marketing plan for a client, a company they advise, or their own product.
- recall — Reconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents).
- show-me-your-work — Keep a reviewable decision trail for long-running or unattended work: a TSV log with one row per decision (what, why, evidence, result).