spec-to-code-compliance — Claude Code skill: what it does & setup
Compares an implementation against technical whitepapers or protocol specifications to flag missing logic, deviations, and unrecorded behavior.
npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-codeWhat spec-to-code-compliance does
The skill evaluates codebases against authoritative texts like whitepapers, RFCs, or formal specifications. Trying to audit dozens of conditions inside a single prompt causes hallucinated confirmations when the context window fills up. To prevent this, the workflow extracts individual requirements and dispatches dedicated subagents to trace the complete caller and callee chains.
Every reported divergence undergoes review by separate verification agents. One subagent re-checks the code paths while another re-examines the specification text, dropping invalid findings before they reach the summary. The final output is stored in spec-compliance/REPORT.md, with per-requirement logs placed in spec-compliance/requirements/. Verdicts classify findings into statuses such as implemented, partial, contradicted, stronger-than-spec, and absent.
Running this check on undocumented code is useless. Without a reference text to establish intended behavior, the agent cannot tell an intentional architectural decision from a defect.
What it helps with
- match codebase behavior against whitepapers and protocol specifications
- detect partial requirement enforcement across unexercised code branches
- catalog undocumented assumptions and constraints present in source files
- audit smart contracts or services against published standards
Example prompts for the agent
- /spec-to-code-compliance:spec-compliance ./contracts
- Inspect a single requirement with spec-to-code-compliance:spec-compliance-checker
How to install spec-to-code-compliance
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-code2Manually: put the files in place
~/.claude/skills/spec-to-code-compliance/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/spec-to-code-compliance/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill spec-to-code-compliance -a codex2Manually: put the files in place
.agents/skills/spec-to-code-compliance/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill spec-to-code-compliance -a cursor2Manually: put the files in place
.cursor/skills/spec-to-code-compliance/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills spec-to-code-compliance2Manually: put the files in place
.github/skills/spec-to-code-compliance/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill spec-to-code-compliance -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/spec-to-code-compliance/skills/spec-to-code-complianceManually: put the files in place
.devin/skills/spec-to-code-compliance/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill spec-to-code-compliance -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about spec-to-code-compliance
How to install spec-to-code-compliance in Claude Code?
Run npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-code. The skill file will be created at ~/.claude/skills/spec-to-code-compliance/SKILL.md.
What does spec-to-code-compliance do?
It identifies discrepancies between source code and its governing documentation. The tool splits documents into specific clauses, evaluates code paths using isolated subagents, and generates markdown audit reports.
Why does the skill assign each requirement to a separate subagent?
Evaluating an enforcement rule requires inspecting both callers and callees. Handling dozens of rules in one context leads to superficial checks based on function names rather than thorough code tracing.
