Skip to content
Back to skills

Coverage Audit

ASecurity

Read-only cross-artifact consistency analyzer (port of spec-kit /analyze). 6 detection passes (Duplication/Ambiguity/Underspec/Constitution-Align/Coverage/Inconsistency) with CRITICAL/HIGH/MEDIUM/LOW severity. Capped at 50 findings. Manual-only invocation via /spawn coverage-audit <PLAN-NNN>. Never modifies files.

  • 2 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 2, 2026
ai-agentsgogit

Security analysis

A100/100

Scanned September 2, 2026

npx -y skills add Canhada-Labs/ceo-orchestration --skill coverage-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Coverage Audit?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Coverage Audit
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/canhada-labs-coverage-audit/badge)](https://www.skillsdirectory.com/skills/canhada-labs-coverage-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: coverage-audit
description: Read-only cross-artifact consistency analyzer (port of spec-kit /analyze). 6 detection passes (Duplication/Ambiguity/Underspec/Constitution-Align/Coverage/Inconsistency) with CRITICAL/HIGH/MEDIUM/LOW severity. Capped at 50 findings. Manual-only invocation via /spawn coverage-audit <PLAN-NNN>. Never modifies files.
owner: Staff Code Reviewer + QA archetype (cross-cut)
domain: core
priority: 2
risk_class: low
context_budget_tokens: 1400
activation_mode: manual-only
read_only: true
inactive_but_retained: false
stack: []
plan_origin: PLAN-110
added_at: 2026-05-20
---

# coverage-audit — read-only cross-artifact consistency analyzer

> **Activation**: manual-only via `/spawn coverage-audit <PLAN-NNN>`.
> Never invoked by `/debate`, `/execute`, or `/ceo-boot` by default.
> Tier-A defensibility per ADR-125 §143-150 (zero token spend in steady state).

## Purpose

Port of github/spec-kit's `/speckit.analyze` (`templates/commands/analyze.md:L340-L381`).
Performs 6 detection passes across the loaded PLAN + canonical roadmap +
findings-master + ADR ledger. **STRICTLY READ-ONLY** — never modifies files
(enforced by `read_only: true` frontmatter + skill text contract).

## 6 detection passes (severity-classified)

| # | Pass | Severities flagged |
|---|------|---|
| 1 | Duplication        | HIGH (same AC text in 2+ plans) / MEDIUM (paraphrase) |
| 2 | Ambiguity          | HIGH (vague terms — "should", "may", "TBD"; **LIVE `[NEEDS CLARIFICATION: …]` marker** — PLAN-SCHEMA §14) / LOW (jargon w/o anchor) |
| 3 | Underspecification | CRITICAL (AC missing path) / HIGH (AC missing severity) |
| 4 | Constitution Alignment | CRITICAL (CLAUDE.md drift vs PLAN-NNN.related_adrs) |
| 5 | Coverage Gaps      | HIGH (AC -> no test file) / MEDIUM (AC -> 1 test only) |
| 6 | Inconsistency      | HIGH (status conflict draft vs reviewed) / LOW (date drift) |

Severity tiers: CRITICAL / HIGH / MEDIUM / LOW.
Limit: **50 findings max** per invocation; overflow summarized with
`+N more findings (run with --no-cap for full output)`.

### Pass #2 (Ambiguity) — inline clarification markers (PLAN-138 Wave A)

Pass #2 additionally flags a **LIVE** `[NEEDS CLARIFICATION: <question>]`
marker at **HIGH** severity. A LIVE marker is the actionable
colon-question-bracket token appearing OUTSIDE fenced code blocks and
inline-backtick spans (a backticked example like the token in this
sentence is EXEMPT, not a finding). This mirrors PLAN-SCHEMA §14 and the
`check-staleness.py` / `validate-governance.sh` advisory detectors. The
read-only contract is unchanged: the skill reports the marker, it never
edits the plan to remove it.

## Invocation contract

```
/spawn coverage-audit PLAN-NNN
```

Output: structured markdown table with deterministic ordering
(stable sort key = `(severity, pass_id, path, line)`). Reproducible
across 3 runs (same input -> same output hash).

## Constitution alignment check

Cross-checks PLAN-NNN's `related_adrs:` frontmatter against:

- CLAUDE.md §Critical Rules (current doctrinal anchors)
- PROTOCOL.md §Plan->Debate->Execute (governance contract)
- Each cited ADR-NNN status (must be ACCEPTED, not RETRACTED/SUPERSEDED)

Flags `CRITICAL` if any related_adr is RETRACTED.
Flags `HIGH` if any related_adr is SUPERSEDED without `superseded_by:` chain
recovery.

## Output format

```
# coverage-audit PLAN-NNN — generated YYYY-MM-DD

| Severity | Pass | Path | Line | Finding |
|----------|------|------|------|---------|
| CRITICAL | 4    | ... | ...  | ...     |
| HIGH     | 1    | ... | ...  | ...     |
...

# Summary
- Critical: N
- High:     N
- Medium:   N
- Low:      N
- Total:    N (capped at 50; +M more) [if applicable]
```

## Anti-pattern boundary

- Skill does NOT call `/debate` or `/execute`.
- Skill does NOT write to any file (read_only enforced).
- Skill does NOT trigger LLM calls when not invoked.
- Skill must NOT be added to `/ceo-boot` Tier-S default checks without
  ADR + kill-switch + debate (per Wave H doctrine).

## Tests

See `tests/skills/test_coverage_audit_skill.py` — 5 fixture cases asserting:
deterministic ordering, ≤50 findings, severity classification correct,
`activation_mode: manual-only` flag respected, `read_only: true` flag respected.

## References

- Port source: github/spec-kit `templates/commands/analyze.md:L340-L381`
- PLAN-110 Wave A acceptance metric
- ADR-125 §143-150 (Tier-A defensibility)
- Wave H activation-mode doctrine

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…