intended-vs-implemented
The method for finding the gap between what a system is supposed to do
by phurynFree
Description
intended-vs-implemented is an agent skill that describes a method for finding the gap between what a system is supposed to do and what its code actually does. Its premise is that a linter checks code in isolation and can confirm that it is consistent, but it cannot tell whether the code does what was intended, because it has no model of intent. The bugs that matter most often sit in that gap: a permission that is documented but never enforced, an endpoint described as cron-only that anyone can call, or a field marked as public that leaks private data. The skill works by comparing written intent against the implementation, so it depends on the intent being written down first, which the shipping-artifacts skill covers. It is aimed at security reviewers and engineers doing correctness audits. The skill is part of the pm-skills collection by phuryn and is listed on skills.sh as free.…
Highlights
- Compares documented intent with what the code does
- Targets bugs that linters and generic scanners miss
- Examples include unenforced permissions and leaked fields
- Depends on intent being written down first
Ratings & Reviews
No ratings yet
Be the first to rate intended-vs-implemented.
People also visit
thermo-nuclear-review
Comprehensive security and correctness audit of a branch's changes
intent-driven-development
Turn ambiguous or high-impact product and engineering changes into scoped
application-security-testing
Application security testing (AppSec) across a whole product with Strix
improve-animations
Survey a codebase's animation and motion code as a senior motion advisor
intended-vs-implemented FAQ
What problem does it solve?
It finds places where the code does not do what the system was meant to do, which generic linters usually miss.
What does it need from me?
A written statement of intent, such as the permissions and rules the system should follow.
Give me an example.
A permission that is documented but never enforced, or a field marked public-only that leaks private data.
Who is it for?
Security reviewers and engineers auditing correctness.
How do I install it?
Run npx skills add https://github.com/phuryn/pm-skills --skill intended-vs-implemented in your terminal.
Is it free?
The listing shows the skill as free.
What are the best intended-vs-implemented alternatives?
Popular alternatives to intended-vs-implemented include ponytail-audit, thermo-nuclear-review and intent-driven-development. See all intended-vs-implemented alternatives