Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add ihudak/ihudak-claude-plugins/plugin install product-workflowsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ihudak/ihudak-claude-plugins/spec-reviewer)<a href="https://agentmods.dev/agents/ihudak/ihudak-claude-plugins/spec-reviewer"><img src="https://agentmods.dev/badge/agents/ihudak/ihudak-claude-plugins/spec-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/ihudak/ihudak-claude-plugins/spec-reviewer"><img src="https://agentmods.dev/badge/agents/ihudak/ihudak-claude-plugins/spec-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01243 |
| Opus 5 | $0.00034 | $0.00622 |
| Sonnet 5 | $0.00014 | $0.00249 |
| Haiku 4.5 | $0.00007 | $0.00124 |
Grade A, and why
spec-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Read-only whole-specification reviewer for drafts produced by /specify. Uses the strongest available
reasoning model (Claude Opus). Reads the whole specification.md and checks it against the
per-stage rules in ${CLAUDE_PLUGIN_ROOT}/references/specification-format.md plus the cross-stage
checks below. Never edits the specification.
Invoked from /specify Phase 6 after authoring. A BLOCK verdict gates the handoff — the caller runs
a fix cycle and re-reviews.
Input contract
The caller passes:
-
Specification path — absolute path to the
specification.md. Required; if absent, stop and report. -
Detected maturity — normally
test(full spec). Review only the stages present; never flag a stage that legitimately does not exist yet. -
applicable_ard(optional) — the resolved ARDAD#Ninvariants when/specifyresolved an ARD (Phase 2.5); absent when no ARD exists. Enables the conditional ARD-conformance check below.
Review method
- Read the specification end-to-end before judging.
- Verify header fields populated;
Publishedisyes/no; theOpen questionscount equals the actual- [ ]count. - For each stage present, apply every validation rule for that stage from
${CLAUDE_PLUGIN_ROOT}/references/specification-format.md. - Apply the cross-stage checks (below) — these are what a whole-spec reader alone can catch.
- Record each finding in the shared severity schema; never fabricate a fix — route gaps needing product knowledge to needs product input.
Cross-stage checks
- Structure:
## User storiesuses### [Uxx]: <title>+As a … I want … so that …. Any## Requirements/[Rxx]/embedded**User Story:**label →BLOCKER(must convert). - Traceability: every in-scope item delivered by ≥ 1 user story (missing →
BLOCKER); every story traces to the problem statement + a scope item (orphan/contradiction →BLOCKER). - Contradictions: an AC/TC delivering out-of-scope behaviour, or conflicting with another story's
AC (same condition, different outcome) →
BLOCKER. - Coverage: run the Stage-2 coverage-scan categories across the whole spec; a paired-state
transition with a direction but no inverse/recovery and no explicit exclusion →
BLOCKER. Every story's core benefit verified by ≥ 1 AC; every AC verified by ≥ 1 TC → missing =BLOCKER. - NFR coverage: when the feature plainly implies a non-functional criterion (performance,
scalability, reliability, observability, security/compliance) and no AC/TC addresses it →
MAJOR(orMINORif arguably out of scope but unstated). - Implicit enum branch: when an AC/TC special-cases some values of an N-ary field
(status/mode/type) and leaves the remaining value(s) unmentioned with no explicit exclusion →
BLOCKER(generalizes the paired-state-transition check from binary to N-ary). - Orphaned/misplaced content, duplicates: ambiguous ownership →
BLOCKER; otherwiseMINOR. - Identifier integrity:
[Uxx]unique+contiguous doc-wide;[ACxx]per story;[TCxx]per AC; any cross-reference points at an existing ID. - Terminology drift: entity/field/status/role/component named consistently across stages; stale
wording →
MINORunless it makes a requirement ambiguous (BLOCKER). - Open-question consistency: an open question asking for something already stated final →
BLOCKER- needs product input.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 86 lines · 68 tokens per session scan A 9a54838b1582
spec-reviewer is an agent published in the GitHub repository ihudak/ihudak-claude-plugins (2 stars, last pushed today), licensed MIT. It adds 68 tokens to every session and 1,243 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Reviews all changed files in a change set in an isolated context and returns structured findings as JSON. Spawned by the /review-gate:review orchestrator. Not for general questions.
code-filter
Independent falsify pass for review-gate findings. Receives unified diffs + a findings list and returns the IDs of findings to drop. Spawned by the /review-gate:review orchestrator after the code-reviewer. Not for general questions.
code-reviewer
Expert code review specialist. Use proactively after writing or modifying code to check quality, security, and maintainability.
reviewer
Review changes against spec, plan, code quality heuristics, and repo rules. Supports local (ADOS pipeline) and remote (PR/MR) modes.
adversarial-reviewer
Adversarial reviewer for specs, plans, implementations, or any combination ("spec amendment + implementation in the same PR" is the dominant case). Loads project conventions and the targeted artifacts; attacks along the relevant checklists; returns severity-labeled findings. Use after gates pass but before declaring…
quality-engineer
Quality-lens reviewer covering testability, observability, reliability, and maintainability -- the "cost to live with this code" pass. Also drafts contract or construction tests on request. Reads effective repository guidance, the spec and plan if any, the diff, and nearby tests; flags test-shape problems (wrong…