spectra-audit

Audit git diffs for security sharp edges using the spectra CLI.

Updated Apr 10, 2026
One-click install
npx skills add https://github.com/kaochenlong/handshake --skill spectra-audit-kaochenlong
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: spectra-audit
Source: https://github.com/kaochenlong/handshake/tree/main/.claude/skills/spectra-audit
Command: npx skills add https://github.com/kaochenlong/handshake --skill spectra-audit-kaochenlong

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit changed code for security sharp edges — API design traps, dangerous defaults, and interfaces that make it easy to do the wrong thing. Good APIs don't require developers to "be careful" to stay secure. If the correct usage requires reading docs, remembering rules, or understanding cryptography, the API has failed.

Core Features & Use Cases

  • Standalone Mode: Full 3-agent parallel analysis on the current git diff.
  • Discipline Mode: via /spectra-apply when audit: true — condensed checklist applied during implementation.
  • Core Framework: Shared framework guiding safe-by-design APIs and risk assessments.

Quick Start

Invoke spectra-audit on the current diff to start the security audit.

Frequently Asked Questions about spectra-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit git diffs for security vulnerabilities and risky API defaults?

You can audit git diffs for security vulnerabilities by running a 3-agent parallel analysis on changed code to identify dangerous defaults, API design traps, and interfaces that make it easy to do the wrong thing.

What is safe-by-design API risk analysis and how does it work?

Safe-by-design API risk analysis evaluates changed code to find sharp edges where correct usage requires reading docs or remembering rules, guiding risk assessments so developers do not have to be careful to stay secure.

Do I need the spectra CLI to analyze code diffs for security gaps?

Yes, you need the spectra CLI and a git diff input to orchestrate the security analysis and report findings on changed code.

Can I run a security checklist during implementation instead of a full audit?

Yes, you can apply a condensed security checklist during implementation using Discipline mode, which evaluates code diffs for risky defaults as you write.

What is the best way to find dangerous API design traps in changed code?

The best way to find dangerous API design traps is running a standalone full 3-agent parallel analysis on your current git diff to report security gaps and risky defaults.

When should I not use a full 3-agent security audit on my code?

You should avoid a full 3-agent standalone audit during active implementation; instead, use Discipline mode to apply a condensed checklist that evaluates code diffs without interrupting your workflow.