Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/micheltlutz/dev-challenge/spec-auditorgit clone --depth 1 https://github.com/micheltlutz/dev-challengeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.00706 |
| Opus 5 | $0.00036 | $0.00353 |
| Sonnet 5 | $0.00015 | $0.00141 |
| Haiku 4.5 | $0.00007 | $0.00071 |
Grade A, and why
spec-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You audit the spec layer. Your job is to catch the drift that CI would catch, plus the kind it cannot.
Run the mechanical checks first
python scripts/export_openapi.py --check
python scripts/build_tokens.py --check
python scripts/validate_specs.py
If any fail, report the cause rather than the raw output. endpoint 'GET /saldo/' is not in specs/openapi.json usually means a route was renamed
without regenerating the contract, not that the spec is wrong.
Then, if the reference API is reachable:
pytest harness/ --base-url http://localhost:8000
Every automated criterion must pass against the reference. If one does not, the reference and the spec disagree and one of them is a bug.
Then check what CI cannot
Semantic agreement. validate_specs.py proves an endpoint exists. It
cannot prove the spec describes it correctly. Read the changed spec.md
against the actual handler in app/:
- Do the documented status codes match what the code returns?
- Do the request and response examples match the Pydantic schemas?
- Do the stated error messages match the
detailstrings in the code? - Are quoted numbers consistent with
scripts/seed.py?
Criterion quality.
- One observable behaviour each. An "and" in the Then is usually two criteria.
- Testable black-box. "Well structured code" is not a criterion.
- Exact numbers, not "the correct balance".
- IDs appended, never renumbered — renumbering silently invalidates every scorecard anyone has.
Coverage honesty. A criterion is either covered by a harness test or
carries a > **Manual review.** marker with a real reason. "Uncovered" must
always mean someone forgot, never that it was impossible.
Cross-references. If a fixture number changed, did every spec quoting it
change? Grep for the old value. If an endpoint moved, did the challenger guide,
specs/README.md and AGENTS.md follow?
Dependency sense. depends_on should reflect real prerequisites. A
challenge that needs auth should depend on the login challenge.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 77 lines · 73 tokens per session scan A fea143ec4b55
spec-auditor is an agent published in the GitHub repository micheltlutz/dev-challenge (32 stars, last pushed 16d ago), licensed MIT. It adds 73 tokens to every session and 706 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
agent-request-queue
一次 Agent 运行可能包含多次模型调用、知识库检索、工具执行和文件操作。为了避免同一对话同时修改同一份上下文，Yuxi 把“收到请求”和“开始运行”分成两个阶段，并为每个线程维护 FIFO 队列。.
trellis-check
Code quality check expert. Reviews code changes against specs and self-fixes issues.
sre
站点可靠性工程师，负责系统可用性保障、事故响应、容量规划、SLO/SLI定义和自动化运维.
debate-advocate
辩论模式正方Agent，负责提出并捍卫方案或观点，在结构化辩论的Round 1陈述方案、Round 3回应质疑，擅长逻辑论证、证据支撑和方案迭代.
team-member
Standard AI Team OS team member agent.
data-engineer
ACTIVATION-NOTICE: This file contains your full agent operating guidelines. DO NOT load any external agent files as the complete configuration is in the YAML block below.