Spec Coder

Structured spec-first development workflow with multi-role expert review gates: clarify requirements, author spec documents (requirements/design/tasks), gene...

This skill appears to implement a reasonable spec-first workflow, but there are a few things to check before installing or using it: - Repository/file access: the skill instructs the agent to read the project codebase and specs. If your repo contains secrets (.env files, API keys, private config), consider removing or redacting them before running the skill, or restrict the agent's workspace to only the docs/specs subtree. - Tooling & permissions: the workflow mentions generating code, running tests, and creating merge/delta commits, but the skill metadata does not list required tools (git, language runtimes, test runners) or required write permissions. Ensure the runtime environment has the appropriate build/test tools and grant the agent only the minimal filesystem/git permissions needed. - Auto-approve and review preferences: the skill supports auto-approval policies (including an explicit "Auto-approve all gates" preference). Treat these as sensitive settings — avoid enabling global auto-approve unless you fully trust the agent and audit outputs. - Audit generated changes: require a human review step (or a protected branch) before any automatic merge-to-trunk is applied. Prefer the skill generate delta.md and pull requests rather than making direct commits. - If you need higher assurance: ask the skill author for explicit lists of required binaries and exact commands the agent will run for Phase 0–4, and for an explicit scope of file paths the skill will read/write. If the author can't provide that, use the skill in a sandboxed repository copy only.

Type: OpenClaw Skill Name: spec-coder Version: 0.1.4 The 'spec-coder' skill bundle implements a highly structured, spec-driven software development lifecycle (SDLC) workflow. It guides the agent through requirements gathering, technical design, code generation, and automated verification. Security is explicitly addressed in the 'expert-review-protocol.md' and 'templates.md' files, which instruct the agent to simulate a Security Expert role to check for input validation, parameterized queries, and hardcoded secrets. The high-privilege actions described (codebase scanning and test execution) are necessary for the stated purpose and are governed by a rigorous phase-gate system without any evidence of malicious intent, data exfiltration, or unauthorized persistence.