# Spec To Code Compliance

Check code against the documentation that specifies it - which requirements hold, which...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Design
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill spec-to-code-compliance -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill spec-to-code-compliance -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill spec-to-code-compliance -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill spec-to-code-compliance -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Spec-to-Code Compliance

Two artifacts disagree, and the job is to find where. The documentation says what the system does; the code
decides what it actually does. Every gap between them is either a bug or a documentation fix, and which one it
is is the finding.

## When to Use

You have both documentation describing intended behavior and the code that should implement it. A whitepaper
against a protocol, a design note against a service, a README's stated guarantees against the functions behind
them.

Most useful when the document is authoritative, something a client wrote, published, or is audited against, because then a divergence is a defect rather than stale prose.

## When NOT to Use

Not for code with no documentation of intended behavior. There is nothing to check against, and a requirement
inferred from the code is checked against itself. Build the system model first with `audit-context-building`.

Not for finding bugs in general. This finds one class: where the code and the document disagree. A bug both
artifacts are silent about is out of scope, and a bug the document endorses is a finding against the document.

Not for writing or improving documentation, though it produces the list of what needs fixing.

## Do not check requirements in this context

Run `/spec-to-code-compliance:spec-compliance <path>`. The slash command takes a path; to name the
specification directly or widen the fan-out, ask for the run with those values, "run spec-compliance on
./contracts against SPEC.md, checking 20 requirements", and they reach the script as `{path, spec, limit}`.
Typing the object literally after the slash command does not work; it arrives as a string and becomes the path.

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/spec-to-code-compliance/skills/spec-to-code-compliance/SKILL.md