implement-mainspec
Implements a mainspec end-to-end by auto-detecting mode. Sequential mode (≤3 slices) commits slices in order on the current `feature/<feature>` branch. Parallel mode (>3 slices) uses dependency-aware tiered execution with per-slice worktrees, branches, PRs, and auto-merge into the feature branch. Agent-first — invoked headless by the harness dispatcher with the feature slug as its single argument. No human-in-the-loop, no approval gates.
64
78%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./skills/sdd/implement-mainspec/SKILL.mdSecurity
2 findings: 1 critical severity, 1 medium severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The skill enables fully automated, agent-driven code changes with elevated subagent privileges ("bypassPermissions"), automatic execution of repo-provided bootstrap scripts, and unattended creation/auto-merge/push of branches to origin with no human approval — a clear enabler for supply-chain/backdoor insertion, remote code execution, and unauthorized code/data exfiltration.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
The skill explicitly instructs spawning subagents with mode "bypassPermissions" (an instruction to bypass security/permission controls) and performs automatic repository and remote state changes (git worktrees, commits, pushes, PR creation and auto-merges) with no approval gates, which together indicate a high risk of compromising the machine or environment state.
- Repository
- tdg-ninja/context-specs-factory-ai
- Commit
3a7a725
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.