Commands
The nine slash commands speckit-security adds to Spec Kit.
speckit-security adds nine slash commands to whichever AI agent
you're using. Every command is an agent-neutral Markdown file under
commands/ in the extension repo, Spec Kit translates each one into
the active agent's native format on install.
| Command | One-line purpose |
|---|---|
data-contract | Declare sources, schemas, PII strategy, bias audit, drift thresholds |
threat-model | Generate a STRIDE threat model for the active spec |
model-governance | Pin model version, define eval baselines, write rollback plan |
guardrails | Generate versioned system prompt + guardrail YAML for AI features |
gate-check | Run all seven gates against the active spec, emit verdict |
audit | Post-implementation scan — inline prompts, secrets, direct SDKs (polyglot) |
dep-audit | Dependency CVE scan (Gate G) via osv-scanner / pnpm / npm / yarn |
red-team | Generate adversarial scenarios; --run hits staging automatically |
install-rules | Install dev rules into docs, constitution, and agent context file |
Naming convention
All commands live under the speckit.tekimax-security.* namespace:
/speckit.tekimax-security.data-contract
/speckit.tekimax-security.threat-model
/speckit.tekimax-security.model-governance
/speckit.tekimax-security.guardrails
/speckit.tekimax-security.gate-check
/speckit.tekimax-security.audit
/speckit.tekimax-security.red-team
/speckit.tekimax-security.install-rulesThis follows Spec Kit's extension command naming pattern:
speckit.{extension-id}.{command-name}.
Which commands fire automatically
Five of the eight commands are wired to Spec Kit phase hooks and fire automatically. Three are manual-only, you invoke them when you need them.
Automatic (via hooks)
data-contractfires after/speckit.specify(optional, prompts)threat-modelfires after/speckit.plan(optional, prompts)gate-checkfires before/speckit.implement(blocks on failure)auditfires after/speckit.implement(blocks on critical findings)red-teamfires before/speckit.analyze(optional, prompts)
Manual
model-governance, run once at DESIGN time when adding an AI featureguardrails, run once when adding an AI featureinstall-rules, run once at project setup
The three optional-prompt hooks (data-contract, threat-model,
red-team) can also be invoked manually if you opt out of the
prompts or want to re-run them later.
Skipping a hook
To skip an optional hook without disabling the extension, answer "no" at the prompt. To skip a required hook (gate-check, audit), you have to either:
- Fix the issue the gate is catching, or
- Temporarily disable the extension with
specify extension disable tekimax-security - Edit the installed
extension.ymlto make the hook optional
See Customization for the long form.