Agent skill · Audited from source
spec-driven-implementation
skill · warpdotdev/common-skillsMIT licenceAudited 31 Oct 2026 · source 09b9a1833d94
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 09b9a1833d94 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Drive a spec-first workflow for substantial features by writing PRODUCT.md before implementation, writing TECH.md when warranted, and keeping both specs updated as implementation evolves. Use when starting a significant…
Cite
Cite this page
ModelsAtlas. “spec-driven-implementation (warpdotdev/common-skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/warpdotdev/spec-driven-implementation
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 09b9a1833d94 · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherwarpdotdev GitHub organizationOwner of the repository this skill is read from
- Source folderwarpdotdev/common-skills/.agents/skills/spec-driven-implementationThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict09b9a1833d94A new audit runs when the source changes
- Repository statusNot archivedLast push 3 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Drive a spec-first workflow for substantial features by writing PRODUCT.md before implementation, writing TECH.md when warranted, and keeping both specs updated as implementation evolves. Use when starting a significant…
--- name: spec-driven-implementation description: Drive a spec-first workflow for substantial features by writing PRODUCT.md before implementation, writing TECH.md when warranted, and keeping both specs updated as implementation evolves. Use when starting a significant feature, planning agent-driven implementation, or when the user wants product and tech specs checked into source control. --- # spec-driven-implementation Drive a spec-first workflow for substantial features in Warp. ## Overview Use this skill for significant features where a written spec will improve implementation quality, reduce ambiguity, or make review easier. Be pragmatic: not every change needs specs. Specs should usually live in: - `specs/<linear-ticket-number>/PRODUCT.md` - `specs/<linear-ticket-number>/TECH.md` For example: - `specs/APP-1234/PRODUCT.md` - `specs/APP-1234/TECH.md` `specs/` should contain only ticket-named directories as direct children. Do not create engineer-named subdirectories or feature-slug directories there. If a relevant Linear issue does not already exist, create one before writing specs. Use the Linear MCP tools directly: - `list_teams` to find the appropriate team - `list_issue_labels` to inspect the expected labels/tags - `save_issue` to create the issue with the appropriate team and labels If the correct team or labels are not obvious from the request and surrounding context, use `ask_user_question` to clarify rather than guessing. These specs should largely be written by agents, not by hand, and should be checked into source control so they can be reviewed and kept current with the code. ## When specs are required Strongly prefer specs when the change is substantial, such as: - product or architectural ambiguity - expected implementation size around 1k+ LOC - deep or cross-cutting stack changes - risky behavior changes where regressions would be expensive - work where agent quality will improve materially from clearer inputs Specs are often unnecessary for: - small, local bug fixes - straightforward refactors - narrow UI tweaks with little ambiguity For pure UI changes, the product spec is often useful while the tech spec may be unnecessary. ## Workflow ### 1. Decide whether the feature needs specs Evaluate the size, ambiguity, and risk of the feature. If specs will not meaningfully improve execution or review, skip them and focus on verification instead. ### 2. Write the product spec first Before implementation, create `PRODUCT.md` describing the desired user-facing behavior. Use the `write-product-spec` skill to produce it. The product spec should define: - what problem is being solved - the desired user experience - invariants and edge cases - success criteria - how the behavior will be validated If the feature has UI or interaction design, ask for a Figma mock if one exists. If there is no mock, continue but call that out explicitly in the product spec. Reference the Linear issue in the spec when one exists. Because specs live under `specs/<linear-ticket-number>/...`, this should usually be straightforward. ### 3. Write the tech spec when warranted Use the `write-tech-spec` skill for substantial or ambiguous implementation work. Prefer a tech spec when: - the implementation spans multiple subsystems - architecture or extensibility matters - there are meaningful tradeoffs to document - reviewers will benefit more from reviewing the plan than the raw code It is acceptable to write the tech spec after an e2e prototype if that leads to a more accurate implementation plan. Do not force a premature tech spec when the implementation details are still too uncertain. ### 4. Implement approved specs After the specs are approved, use the `implement-specs` skill to build from the approved `PRODUCT.md` and `TECH.md`. The implementation can often be pushed in the same PR as the product and tech specs. As the engineer iterates, keep `PRODUCT.md`, `TECH.md`, code changes, and tests in that same PR so the review reflects the feature that will actually ship. For large features, the implementer may optionally offer: - `PROJECT_LOG.md` to track explored paths, checkpoints, and current implementation state - `DECISIONS.md` to capture concrete product and technical decisions made during design and implementation These are optional aids, not required outputs. ### 5. Keep specs current during implementation If implementation changes from the spec, update the spec rather than leaving it stale. Update `PRODUCT.md` when: - user-facing behavior changes - success criteria change - UX details or edge cases change Update `TECH.md` when: - the implementation approach changes - architectural boundaries move - risks, dependencies, or rollout details change - the testing or validation plan changes The checked-in specs should describe the feature that actually ships, not just the initial intent. Keep those spec updates in the same PR as the related code changes whenever practical. ### 6. Verify behavior against the spec Before considering the work complete, make sure verification maps back to the specs. Prefer tests and artifacts that validate the product behavior directly: - unit tests and regression coverage that follow the repository's local testing conventions - integration tests for critical user flows - loom walkthroughs or equivalent feature demonstrations when appropriate - screenshots or videos when useful for UI-heavy work ## Best Practices - Be pragmatic above all else. - Write specs to improve input quality for agents, not as ceremony. - Keep product specs behavior-oriented and implementation-light. - Keep tech specs implementation-oriented and grounded in current codebase patterns. - When a spec references relevant code chunks, include the inspected commit SHA in the file reference when possible and link the reference to the exact GitHub `blob/<sha>/...#Lx-Ly` lines. - Use review time to validate specs and behavior, not to over-index on code style nits.
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 09b9a18
git clone https://github.com/warpdotdev/common-skills git -C common-skills checkout 09b9a1833d94
The author documents no install command, so this uses the repository directly. Our verdict covers commit 09b9a1833d94 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
09b9a1833d94
Similar skills
obra/superpowers
Use when creating new skills, editing existing skills, or verifying skills work before deployment
mattpocock/skills
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
Questions about spec-driven-implementation
Is spec-driven-implementation safe to install?
What can spec-driven-implementation access on my machine?
How current is this page?
Sources
- github.com/warpdotdev/common-skills/tree/main/.agents/skills/spe — the audited source at commit 09b9a1833d94 and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- Is spec-driven-implementation safe to install?
- What can spec-driven-implementation access on my machine?
- How current is this page?