
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
open-skilled-sdd
Advanced tools
open spec-driven development workflow: OpenSpec, PRPs, Spec Kit, spec-workflow-mcp, BMad-Method, 6A workflow
Enhancing AI coding assistants through open Spec-driven development (Spec-driven development for AI coding assistants), adopting the Claude Code Skills approach, compatible with various CLI and IDE AI coding assistants that support AGENTS.md.
When the code or documentation generated by an AI coding assistant is disappointing, it's unclear whether it's because:
The focus is on breaking through "2. The AI coding assistant is problematic", but because the built-in spec-driven development methods (context engineering, system prompts, etc.) of various CLI and IDE AI coding assistants are not public, they are basically black boxes, making it impossible to analyze or optimize them yourself. I looked for various open spec-driven development solutions, such as the 6A workflow, PRPs, Spec Kit, OpenSpec, spec-workflow-mcp, BMad-Method, etc., to see which one is the most suitable, and then proceed to optimize it myself. I roughly used these solutions and found that they each have their pros and cons. My first thought was to create a comprehensive solution, integrating the advantages of each solution and removing the parts I thought were unsuitable. I soon discovered that this path was a dead end; this idea is exactly the channel that various AI coding assistants are currently working on. I cannot do better than these vendors. Moreover, from a philosophical point of view, a comprehensive solution (limited capabilities) cannot adapt to all types of scenarios (infinite scenarios). At this time, Claude Code Skills came out. I found this approach good; wouldn't infinite skills be able to adapt to infinite scenarios? At the same time, I found skilled-spec.
My idea is to convert OpenSpec, PRPs, Spec Kit, spec-workflow-mcp, BMad-Method, 6A workflow, etc., including good spec-driven development methods that appear in the future, into individual composable Skills, which are open and can be optimized by yourself.
| Methodology | Skill | Trigger Words | Purpose |
|---|---|---|---|
| openspec | openspec-proposal-creation | "openspec proposal", "openspec plan" | Generate structured proposals with EARS requirements |
| openspec-implementation | "openspec implement", "openspec build" | Execute tasks with testing and progress tracking | |
| openspec-archiving | "openspec archive" | Merge spec differences and create archives | |
| openspec-context-loading | "openspec context", "openspec what specs exist", "openspec show changes" | Discover specs, search requirements, show dashboard | |
| openspec (Chinese) | openspec-proposal-creation-cn | "openspec提案", "openspec需求" | Generate structured proposals with EARS requirements |
| openspec-implementation-cn | "openspec开发" | Execute tasks with testing and progress tracking | |
| openspec-archiving-cn | "openspec归档" | Merge spec differences and create archives | |
| openspec-context-loading-cn | "openspec上下文", "openspec有哪些规范", "openspec显示变更" | Discover specs, search requirements, show dashboard | |
Each skill has detailed documentation in its SKILL.md file.
Copy directly to project (Claude Code, simple):
skills/ in this project to .claude/skills/ in your project.Copy directly to global (Claude Code, simple):
skills/ in this project to ~/.claude/skills/.Plugin-based (Claude Code, auto-update):
/plugin marketplace add forztf/open-skilled-sdd in Claude Code./plugin
-> 1. Browse and install plugins
-> open-skilled-sdd-marketplace
-> Press space to select
-> Press i to install in Claude Code.
Or install them one by one using commands:
/plugin install open-skilled-sdd@open-skilled-sdd-marketplace
Other AI CLI/IDE Installation (for AI CLI/IDE that support AGENTS.md,Codex、Gemini、Cursor):
Use npx for direct installation:
npx open-skilled-sdd # Install skills to .claude/skills/
npx open-skilled-sdd sync # Sync skills to AGENTS.md
Or install globally then use the CLI:
npm install -g open-skilled-sdd
open-skilled-sdd # Install skills locally
open-skilled-sdd install # Explicit install command
open-skilled-sdd sync # Sync to AGENTS.md
open-skilled-sdd --help # Show help
Sync Skills to AGENTS.md:
open-skilled-sdd sync # Auto-sync all skills (creates AGENTS.md if needed)
open-skilled-sdd sync --yes # Same as above (deprecated flag)
Features:
MIT License - see LICENSE
FAQs
open spec-driven development workflow: OpenSpec, PRPs, Spec Kit, spec-workflow-mcp, BMad-Method, 6A workflow
The npm package open-skilled-sdd receives a total of 96 weekly downloads. As such, open-skilled-sdd popularity was classified as not popular.
We found that open-skilled-sdd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.