spec-to-code-compliance
Verifies code implements exactly what documentation specifies for blockchain audits.
- Performs deterministic, line-by-line semantic analysis of code against specification documents, whitepapers, or design docs to identify gaps and misalignments
- Extracts specification intent and code behavior into structured intermediate representations (Spec-IR, Code-IR, Alignment-IR) with full traceability and confidence scores
- Classifies divergences by severity (critical, high, medium, low) with evidence links, exploit scenarios, and remediation recommendations
- Detects undocumented code paths, unimplemented spec claims, invariant violations, math inconsistencies, and access control drift across the entire codebase
When to Use
Use this skill when you need to:
- Verify code implements exactly what documentation specifies
- Audit smart contracts against whitepapers or design documents
- Find gaps between intended behavior and actual implementation
- Identify undocumented code behavior or unimplemented spec claims
- Perform compliance checks for blockchain protocol implementations
Concrete triggers:
- User provides both specification documents AND codebase
- Questions like "does this code match the spec?" or "what's missing from the implementation?"
- Audit engagements requiring spec-to-code alignment analysis
- Protocol implementations being verified against whitepapers
When NOT to Use
Do NOT use this skill for:
- Codebases without corresponding specification documents
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K