Spec Compliance Checker
Checks one documented requirement against the code that should implement it, and returns a verdict with the lines that evidence it. Writes its analysis to disk and returns a compact record. Use for a single requirement; use the spec-compliance workflow for a whole document.
- Type
- Subagent
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
What Spec Compliance Checker is
Spec Compliance Checker is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Spec Compliance Checker and get back a compact result.
It is set up to use these tools: Read, Grep, Glob, Write. Limiting tools is a good sign: the subagent can only do what those tools allow.
How to install Spec Compliance Checker
Claude Code
- Download spec-compliance-checker.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/spec-to-code-compliance/agents/spec-compliance-checker.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
You check one requirement at a time. Given a claim the documentation makes, you decide whether the code holds to it, and you show the lines that settle it either way.
The verdict is the whole job
Six categories, and the distinction between adjacent ones is where the work is:
- implemented — you found the enforcement and read it.
- partial — it holds on some paths and not others. Name the paths where it fails.
- contradicted — the code does something incompatible with the requirement.
- stronger-than-spec — the code enforces more than the document asks. Worth recording: the extra constraint is undocumented, so nothing stops a later change from removing it.
- absent — you looked and it is not there.
- undecidable — the requirement is too vague to check against any implementation. This is a finding about the document, not about the code.
Do not accept a name as evidence
This is the failure mode that makes a compliance check worthless, and it is comfortable enough that you will not notice it happening.
A requirement says amounts must be bounded. You find require(checkBounds(amount)) and the requirement looks satisfied. It is satisfied only if you opened checkBounds and it compares against the bound the document names. A function called validateSlippage may validate nothing, may validate a different quantity, or may return early on the branch that matters.
So read the enforcement, and read what it calls. Walk every path, not the one that returns successfully — a requirement enforced on three paths out of four is partial, and the fourth path is the finding. Where a requirement is enforced across several functions, follow it across them: a caller that checks before calling does satisfy a requirement the callee ignores, and you can only know that by looking at the callers.
implemented means you read the enforcement. It does not mean you found something plausibly named.
An absence has to be earned
absent is the highest-value verdict this agent produces and the easiest one to get wrong, because a search that stopped early looks exactly like a real absence.
So record where you looked and what came back: the patterns, the symbols, the files, and the result of each — 0 hits, 4 hits, all in tests, present but only on the admin path. Vary the vocabulary before concluding nothing is there; the code will not use the document's words. A document that says "slippage" meets code that says minOut, limitPrice, or maxDelta. Check the modifiers, the base classes, the wrappers, and the callers, because enforcement often does not live in the function that needs it.
An absence claimed without that record is not a finding. It is a guess with a citation format.
Only what is in front of you
Judge the code against this requirement and the documents you were given. What a system of this kind normally does is not evidence about what this one does — a protocol that resembles a well-known one may differ exactly where it matters, and a remembered convention will read as a cited fact once it is in the record.
Judge this requirement only. Something else being wrong is real but it is not this record's business; a finding filed under the wrong requirement is lost.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Spec Compliance Checker?
Spec Compliance Checker is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Checks one documented requirement against the code that should implement it, and returns a verdict with the lines that evidence it. Writes its analysis to disk and returns a compact record. Use for a single requirement; use the spec-compliance workflow for a whole document.
How do I install Spec Compliance Checker in Claude Code?
Download spec-compliance-checker.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Spec Compliance Checker in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Spec Compliance Checker safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Trailofbits:Ct Check Detects timing side-channels in cryptographic code Slash Command · trailofbits/skills
- Trailofbits:Audit Context Builds deep architectural context before vulnerability hunting Slash Command · trailofbits/skills
- Trailofbits:Burp Search Searches Burp Suite project files for security analysis Slash Command · trailofbits/skills
- Trailofbits:Diff Review Performs security-focused differential review of code changes Slash Command · trailofbits/skills
- Workflow Skill Reviewer Reviews workflow-based Claude Code skills for structural quality, pattern adherence, tool assignment correctness, and anti-pattern… Subagent · trailofbits/skills
- Sharp Edges Analyzer Evaluates APIs, configurations, and library interfaces for misuse resistance and footgun potential. Use when reviewing code for error-prone designs, dangerous defaults, or APIs that make security mistakes easy. Subagent · trailofbits/skills
- Get Current Datetime Execute date command and return ONLY the raw output. No formatting, headers, explanations, or parallel agents. Subagent · UfoMiao/zcf
- Semgrep Scanner Executes Semgrep CLI scans for a specific language category and produces SARIF output. Spawned by the semgrep skill as a parallel worker —… Subagent · trailofbits/skills