Spec-First Development

Spec-driven development workflow. Before writing any code, generates a comprehensive SPEC.md covering data models, user flows, API contracts, file structure,...

This skill is instruction-only and coherent with its purpose: it will read your project files and write SPEC.md in the project root, then wait for your explicit approval before writing implementation code. Before enabling or running it, confirm: (1) the agent's file-sandbox is limited to the intended repository/workspace so it cannot read unrelated files or secrets; (2) you are comfortable granting the agent Read/Write/Bash capabilities in that workspace (Bash can run arbitrary commands, so sandboxing matters); (3) the auto-trigger rules (phrases like 'build me') won't cause unwanted invocations in your environment. Note the SKILL.md mentions running 'Grep' but only lists 'Glob' explicitly — this is likely benign (grep can be run via Bash) but you may ask the author to clarify allowed-tools or explicit shell usage if you need stricter controls.

Type: OpenClaw Skill Name: spec-first-dev Version: 1.0.0 The skill is designed for a legitimate development workflow, but it requests `Bash` as an `allowed-tool` in `SKILL.md`. While the current instructions only explicitly suggest using `Grep` (a benign use case for `Bash`), granting arbitrary shell access to an AI agent is a significant security risk. This capability, even without explicit malicious instructions, makes the skill suspicious due to the potential for misuse, prompt injection, or unintended execution of harmful commands, classifying it as a vulnerability rather than intentional malice.