SPECIFICATION

A written specification for packaging an agent skill as a directory containing a required SKILL.md file and optional supporting folders.

In plain words
What is it for?
Use it when creating or checking an agent skill, including its instructions, scripts, reference documents, and reusable assets.
Why use it?
It gives skill authors a shared file layout and rules for the required metadata, so skills can be recognized and used consistently.

Agent for Codex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/drakaniia/skills/specification
Clone the repo
git clone --depth 1 https://github.com/Drakaniia/skills

Made for: Codex.

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,528 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01528
Opus 5 $0.00000 $0.00764
Sonnet 5 $0.00000 $0.00306
Haiku 4.5 $0.00000 $0.00153

Measured 3d ago against content hash 61705b078780, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

SPECIFICATION scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/agents/SPECIFICATION.md · 309 lines

How it starts

The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.

# Agent Skills Specification

## Directory Structure

A skill is a directory containing, at minimum, a `SKILL.md` file:

```text
skill-name/
├── SKILL.md          # Required: metadata + instructions
├── scripts/          # Optional: executable code
├── references/       # Optional: documentation
├── assets/           # Optional: templates, resources
└── ...               # Any additional files or directories
```

---

## SKILL.md Format

The `SKILL.md` file must contain YAML frontmatter followed by Markdown content.

### Frontmatter

| Field           | Required | Constraints                                                                                                       |
| --------------- | -------- | ----------------------------------------------------------------------------------------------------------------- |
| `name`          | Yes      | Max 64 characters. Lowercase letters, numbers, and hyphens only. Must not start or end with a hyphen.             |
| `description`   | Yes      | Max 1024 characters. Non-empty. Describes what the skill does and when to use it.                                 |
| `license`       | No       | License name or reference to a bundled license file.                                                              |
| `compatibility` | No       | Max 500 characters. Indicates environment requirements (intended product, system packages, network access, etc.). |
| `metadata`      | No       | Arbitrary key-value mapping for additional metadata.                                                              |
| `allowed-tools` | No       | Space-separated string of pre-approved tools the skill may use. (Experimental)                                    |

### Minimal Example

```yaml
---
name: skill-name
description: A description of what this skill does and when to use it.
---
```

### Example With Optional Fields

```yaml
---
name: pdf-processing
description: Extract PDF text, fill forms, merge files. Use when handling PDFs.
license: Apache-2.0
metadata:
  author: example-org
  version: "1.0"
---
```

---

## `name` Field

The required `name` field:

- Must be 1–64 characters
- May only contain unicode lowercase alphanumeric characters (`a-z`, `0-9`) and hyphens (`-`)
- Must not start or end with a hyphen (`-`)
- Must not contain consecutive hyphens (`--`)
- Must match the parent directory name

### Valid Examples

```yaml
name: pdf-processing
name: data-analysis
name: code-review
```

### Invalid Examples

```yaml
name: PDF-Processing      # uppercase not allowed
name: -pdf                # cannot start with hyphen
name: pdf--processing     # consecutive hyphens not allowed
```

---

## `description` Field

The required `description` field:

- Must be 1–1024 characters
- Should describe both what the skill does and when to use it
- Should include specific keywords that help agents identify relevant tasks

### Good Example

```yaml
description: Extracts text and tables from PDF files, fills PDF forms, and merges multiple PDFs. Use when working with PDF documents or when the user mentions PDFs, forms, or document extraction.
```

### Poor Example

```yaml
description: Helps with PDFs.
```

---

## `license` Field

The optional `license` field:

- Specifies the license applied to the skill
- Recommended to keep it short (license name or bundled license file)

### Example

```yaml
license: Proprietary. LICENSE.txt has complete terms
```

---

## `compatibility` Field

The optional `compatibility` field:

- Must be 1–500 characters if provided
- Should only be included when the skill has specific environment requirements
- Can indicate intended product, required packages, network access requirements, etc.

### Examples

```yaml
compatibility: Designed for Claude Code (or similar products)

compatibility: Requires git, docker, jq, and access to the internet

compatibility: Requires Python 3.14+ and uv
```

Most skills do not need the `compatibility` field.

---

## `metadata` Field

The optional `metadata` field:

- A map from string keys to string values
- Clients can use this to store additional properties not defined by the Agent Skills specification
- Use reasonably unique key names to avoid conflicts

### Example

```yaml
metadata:
  author: example-org
  version: "1.0"
```

---

## `allowed-tools` Field

The optional `allowed-tools` field:

- A space-separated string of tools that are pre-approved to run
- Experimental; support may vary between agent implementations

### Example

```yaml
allowed-tools: Bash(git:*) Bash(jq:*) Read
```

---

## Body Content

The Markdown body after the frontmatter contains the skill instructions.

There are no format restrictions. Write whatever helps agents perform the task effectively.

### Recommended Sections

- Step-by-step instructions
- Examples of inputs and outputs
- Common edge cases

The agent loads this entire file once it activates a skill. Consider moving lengthy content into reference files.

---

## Optional Directories

### `scripts/`

Contains executable code that agents can run.

Scripts should:

- Be self-contained or clearly document dependencies
- Include helpful error messages
- Handle edge cases gracefully

Supported languages depend on the agent implementation. Common options include:

- Python
- Bash
- JavaScript

---

### `references/`

Contains additional documentation that agents can read when needed.

Examples:

```text
REFERENCE.md - Detailed technical reference
FORMS.md     - Form templates or structured data formats
finance.md   - Domain-specific reference
legal.md     - Domain-specific reference
```

Keep individual reference files focused. Agents load them on demand, reducing context usage.

---

### `assets/`

Contains static resources such as:

- Templates
- Images
- Data files
- Schemas
- Lookup tables

Examples:

```text
assets/
├── templates/
├── diagrams/
├── schemas/
└── lookup-tables/
```

---

## Progressive Disclosure

Agents load skills progressively, pulling in more detail only when needed.

### Loading Stages

| Stage                                   | Content                                                                         |
| --------------------------------------- | ------------------------------------------------------------------------------- |
| Metadata (~100 tokens)                  | `name` and `description` fields are loaded at startup for all skills            |
| Instructions (<5000 tokens recommended) | Full `SKILL.md` body is loaded when the skill is activated                      |
| Resources (as needed)                   | Files in `scripts/`, `references/`, and `assets/` are loaded only when required |

### Recommendation

Keep the main `SKILL.md` under **500 lines**.

Move detailed reference material into separate files.

---

## File References

When referencing other files in your skill, use relative paths from the skill root.

### Example

```markdown
See [the reference guide](references/REFERENCE.md) for details.

Read the full file on GitHub · 309 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 309 lines · 0 tokens per session scan A 61705b078780

Subscribe to this mod's changes

SPECIFICATION is an agent published in the GitHub repository Drakaniia/skills (7 stars, last pushed 13d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,528 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.