spec-to-code-compliance

Verify codebase implementation against specification documents with cited evidence.

6.5k|561|Updated Jan 14, 2026
One-click install
npx skills add https://github.com/trailofbits/skills --skill spec-to-code-compliance-trailofbits
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: spec-to-code-compliance
Source: https://github.com/trailofbits/skills/tree/main/plugins/spec-to-code-compliance/skills/spec-to-code-compliance
Command: npx skills add https://github.com/trailofbits/skills --skill spec-to-code-compliance-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps auditors determine whether a codebase implements exactly what documentation states, enabling precise spec-to-code alignment and verifiable compliance across blockchain audits.

Core Features & Use Cases

  • End-to-end spec-to-code verification across logic, invariants, flows, and security guarantees.
  • Phase-wise analysis (Spec-IR, Code-IR, Alignment-IR, Divergence findings, Final report) with evidence-backed conclusions.
  • Support for documenting ambiguities and generating remediation steps.

Quick Start

Provide the specification documents and the codebase, and run the analyzer to generate the Spec-to-Code Compliance report.

Frequently Asked Questions about spec-to-code-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify smart contract code matches the specification during a blockchain audit?

Verify smart contract code matches the specification by comparing specification documents against the codebase to check logic, invariants, flows, and security guarantees. The analysis generates evidence-backed compliance findings citing exact quotes and line numbers.

What is spec-to-code compliance and when do I need it for blockchain protocols?

Spec-to-code compliance is the process of identifying whether a codebase implements exactly what its documentation specifies. It is needed for blockchain protocol audits and compliance reviews where edge cases, math, and security guarantees must be deterministically verified.

How do I check if codebase logic diverges from documentation across invariants and security guarantees?

Check for divergence by running a phase-wise analysis that builds intermediate representations of both the spec and code, then compares them to output alignment findings and remediation steps for any mismatches.

Can I generate a compliance report with line citations for a smart contract audit?

Yes, you can generate a compliance report with line citations. The analysis produces a final report containing deterministic, evidence-based conclusions that cite exact quotes and line numbers from both the specification and the codebase.

Do I need both specification documents and source code to perform spec-to-code alignment?

Yes, spec-to-code alignment requires access to both the specification documents and the codebase. Without both inputs, the analyzer cannot compare logic, invariants, and flows to produce verifiable compliance conclusions.

How do I document ambiguities found when verifying code against documentation?

Document ambiguities by capturing them during the divergence findings phase of the spec-to-code analysis. The process supports documenting ambiguities and automatically generating remediation steps to resolve the mismatches.