spec-to-code-compliance
Installation
SKILL.md
What this skill does
Verifies that a code implementation faithfully matches its specification or design document. Parses the spec into discrete requirements, maps each requirement to the corresponding code location, and flags deviations — missing controls, incorrect state transitions, wrong error handling, overlooked edge cases — with severity ratings and MITRE ATT&CK technique mappings where applicable. Produces a compliance matrix as the primary output.
Applicable to:
- Smart contracts: EIP compliance (ERC-20, ERC-721, ERC-4626)
- API implementations: OpenAPI / Swagger spec adherence
- Protocol implementations: RFC compliance (TLS, OAuth 2.0, JWT)
- Security policies: access control matrices, data handling policies
This skill is distinct from threat-model, which identifies risks before implementation. Here the implementation already exists and is evaluated against a written specification.