spec-attack
Skill0 starsChanged 4 months agoMITView on GitHub
Use before building or auditing against acceptance contracts - systematically finds missing acceptance dimensions so "all green but wrong" cannot ship through contract holes.
In this repository4 other files it gives its agents.
- adjudication-protocolSkill
- merge-disciplineSkill
- oracle-forgingSkill
- tricolor-reportingSkill
The file
Files
Spec Attack
The most dangerous defect is the one the contract never tests for. Attack the contract before anyone spends effort satisfying it. For each unit, walk this checklist and emit a concrete proposed_cmd per hole:
- Performance: is there any latency/throughput/memory bound? A contract with zero perf commands accepts a 100x regression.
- Security: injection surfaces, authz boundaries, secret handling, path traversal. Does any acceptance command exercise them?
- Concurrency & ordering: parallel invocation, reentrancy, lock ordering, idempotency under retry.
- Boundary semantics: empty input, maximum size, unicode/encoding, negative/zero, off-by-one at documented limits.
- Error paths: does acceptance only test the happy path? Force the failure modes and check the contract covers observed behavior.
- Resource lifecycle: file handles, connections, temp files, cleanup on failure.
- Compatibility: documented API/CLI surface stability, serialization format round-trips across versions.
Rules:
- A hole without an executable
proposed_cmdis an opinion — make it testable or drop it. - Rank holes by blast radius, not by ease of writing the test.
- Output feeds the contract patch step; you never modify contracts yourself.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.