# spec-to-code-compliance

Compares an implementation against technical whitepapers or protocol specifications to flag missing logic, deviations, and unrecorded behavior.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5800 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/spec-to-code-compliance/skills/spec-to-code-compliance/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/spec-to-code-compliance

## What it does

The skill evaluates codebases against authoritative texts like whitepapers, RFCs, or formal specifications. Trying to audit dozens of conditions inside a single prompt causes hallucinated confirmations when the context window fills up. To prevent this, the workflow extracts individual requirements and dispatches dedicated subagents to trace the complete caller and callee chains.

Every reported divergence undergoes review by separate verification agents. One subagent re-checks the code paths while another re-examines the specification text, dropping invalid findings before they reach the summary. The final output is stored in `spec-compliance/REPORT.md`, with per-requirement logs placed in `spec-compliance/requirements/`. Verdicts classify findings into statuses such as `implemented`, `partial`, `contradicted`, `stronger-than-spec`, and `absent`.

Running this check on undocumented code is useless. Without a reference text to establish intended behavior, the agent cannot tell an intentional architectural decision from a defect.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/spec-to-code-compliance/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/spec-to-code-compliance/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill spec-to-code-compliance -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/spec-to-code-compliance/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill spec-to-code-compliance -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/spec-to-code-compliance/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills spec-to-code-compliance
```

2. **Manually: put the files in place**
- File: `.github/skills/spec-to-code-compliance/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill spec-to-code-compliance -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/spec-to-code-compliance/skills/spec-to-code-compliance
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/spec-to-code-compliance/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill spec-to-code-compliance -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/spec-to-code-compliance/skills/spec-to-code-compliance/SKILL.md

## When to use it
- match codebase behavior against whitepapers and protocol specifications
- detect partial requirement enforcement across unexercised code branches
- catalog undocumented assumptions and constraints present in source files
- audit smart contracts or services against published standards

## Example prompts
- /spec-to-code-compliance:spec-compliance ./contracts
- Inspect a single requirement with spec-to-code-compliance:spec-compliance-checker

## Similar
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [design-taste-frontend](https://affpapa.org/en/nevibecode/skills/design-taste-frontend.md) — skill · 678700 installs
- [tdd](https://affpapa.org/en/nevibecode/skills/tdd.md) — skill · 1141062 installs
- [skill-creator](https://affpapa.org/en/nevibecode/skills/skill-creator.md) — skill · 414180 installs
- [agent-browser](https://affpapa.org/en/nevibecode/skills/vercel-labs-agent-browser.md) — skill · 1200000 installs
- [prototype](https://affpapa.org/en/nevibecode/skills/prototype.md) — skill · 986201 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md