Speckit.checker

Skill wedabro/bro-skills/.agents/skills/speckit.checker

Static Analysis Aggregator - Run static analysis on the codebase.From its SKILL.md

Install

npx -y skills add wedabro/bro-skills --skill speckit.checker

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.0 KB, 642 tokens by cl100k_base, as published. Nobody here has run it

🎯 Mission

Detect coding-standard violations, security issues, and performance anti-patterns using commands appropriate to the actual project stack. MUST run applicable checks — do not claim a check passed from visual review.

📥 Input

Source code and dependency manifests
.agent/memory/constitution.md (coding standards)
.agent/project.json and documented build/test commands
Docker files when the project is containerized

📋 Protocol

Phase 1: Capability Discovery

Read project configuration and dependency manifests.
Detect language, package manager, containerization, services, and available build/lint/type-check scripts.
Build an applicability table. Mark unavailable checks N/A with a reason; never treat N/A as a pass or failure.

Phase 2: Compile, Type, and Lint Checks

Run the repository-defined compile, type-check, and lint commands.
If the constitution requires container execution, run them in the matching service. Otherwise use the project's documented runtime.
Compiler/type errors are 🔴 CRITICAL. Lint severity follows project policy.
Do not assume TypeScript, npm, a monorepo, or fixed service names.

Phase 3: Container Checks (When Applicable)

Validate every discovered Compose file with docker compose ... config.
Verify Dockerfile COPY sources, non-root production runtime, health checks, environment-driven published ports, and no production source shadowing.
If the project is not containerized, record this phase as N/A.

Phase 4: Configuration and Security

Scan source and tracked files for likely secrets, unsafe URL/endpoint literals, injection sinks, unsafe HTML, dynamic evaluation, and SQL concatenation.
Exclude generated/vendor directories and report redacted locations only.
Treat intentional public URLs, documentation links, and schema identifiers according to project policy rather than flagging every https:// literal.

Phase 5: Stack-Specific Integrity

Apply framework checks only when that framework is detected.
For monorepos, verify package exports and cross-package contracts.
For server-rendered applications, inspect build-time data fetching and error behavior according to the framework and project requirements.

📤 Output

File: .agent/memory/checker-report.md

Format:

## 🔴 CRITICAL (N issues)
- `apps/web/src/app/page.tsx:65` — Property 'category' does not exist on type 'Article'
## 🟡 WARNING (N issues)
- `compose.prod.yml:40` — Source mount overrides the built production artifact
## 🟢 INFO (N issues)
- ...

🚫 Guard Rails

Report ONLY — DO NOT edit the code yourself.
Each finding must have a specific file path + line number.
MUST run every applicable configured check; visual scanning alone is not enough.
If there is 🔴 CRITICAL → FAIL conclusion, deployment is NOT allowed.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most quality gates skills give in 642 tokens

Counted across 1,195 of the 2,094 authors here whose files we hold, read 2026-08-07

Read the output and check the exit codein 54 of 1195, across 14 files
Verify requirements using a line-by-line checklistin 53 of 1195, across 12 files
Identify the verification command proving the claimin 51 of 1195, across 12 files
Run the full verification commandin 50 of 1195, across 11 files
Verify output confirms the claimin 49 of 1195, across 12 files
Check version control diff after agent delegationin 46 of 1195, across 6 files
State claim with evidencein 44 of 1195, across 4 files
Run the test suitein 33 of 1195, across 26 files
Keep state in memory by defaultin 27 of 1195, across 6 files
Make prototype runnable with one commandin 26 of 1195, across 5 files
Produce a verification reportin 25 of 1195, across 14 files
Detect the package manager from lockfilesin 24 of 1195, across 5 files

Said here and by no other author read

build an applicability table for available checks
run repository-defined compile type-check and lint commands
execute checks in the constitution-specified container runtime
mark unrunnable checks as not applicable with a reason
verify dockerfile sources non-root runtimes and health checks
scan source files for secrets and injection sinks

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.