Overview
spec-to-code-compliance is an open-source security skill for Claude Code and compatible agents, published by trailofbits. Its author describes it as: “Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation ag…”. The project has 6.6k stars on GitHub and is available under the CC-BY-SA-4.0 license. Add it to your setup with `/plugin marketplace add trailofbits/skills`.
What spec-to-code-compliance does
Two artifacts disagree, and the job is to find where. The documentation says what the system does; the code decides what it actually does. Every gap between them is either a bug or a documentation fix, and which one it is is the finding.
Best for
What’s inside
The SKILL.md for spec-to-code-compliance is organised into these sections:
- When to Use
- When NOT to Use
- Do not check requirements in this context
- What comes back, and how to read it
- Judgment the workflow does not make for you
- The target does not have to be a contract
- Reference
Installation
Add spec-to-code-compliance to your agent with:
/plugin marketplace add trailofbits/skillsReview a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.
Supported agents
- Claude Code — ships a claude code plugin marketplace
License
spec-to-code-compliance is published under the CC-BY-SA-4.0 license.
Strengths
- Clear CC-BY-SA-4.0 license — safe to read and adapt within its terms
- Ships in trailofbits/skills, an established project with 6,646 GitHub stars
- Works with Claude Code
- Actively maintained — repository updated in the last 90 days
Author
Topics
Alternatives to spec-to-code-compliance
Similar skills from other repositories:
Frequently asked questions
- What does spec-to-code-compliance do?
- Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.
- How do I install spec-to-code-compliance?
- Run /plugin marketplace add trailofbits/skills in your agent, then reload your skills. Review the source at https://github.com/trailofbits/skills before installing.
- Is spec-to-code-compliance free to use?
- Yes. spec-to-code-compliance is free and open source under the CC-BY-SA-4.0 license, so you can read, run, and adapt it within that license's terms.
- Which agents does spec-to-code-compliance work with?
- spec-to-code-compliance lists Claude Code — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
- Where does spec-to-code-compliance come from?
- spec-to-code-compliance ships inside trailofbits/skills, a repository that contains 41 catalogued skills in total. The repository's 6,646 GitHub stars apply to that whole collection, not to this skill on its own.