A command that reviews a development story's non-functional requirements—the qualities around how software works, such as security, speed, reliability, and maintainability. It produces a short assessment and a YAML result for a quality gate file.

Use it to assess the core four non-functional areas for a story and save the findings for quality review. It can use the story's acceptance criteria, architecture references, and technical preferences.

It helps reveal risks that ordinary feature requirements may miss, such as weak security or unclear reliability evidence. If the story is missing, it records that the target is unknown instead of pretending the assessment is complete.

How hollandkevint/thinkhaven configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to hollandkevint/thinkhaven. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/hollandkevint/thinkhaven/main/.claude/commands/BMad/tasks/nfr-assess.md

Clone the repo

git clone --depth 1 https://github.com/hollandkevint/thinkhaven

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/hollandkevint/thinkhaven/nfr-assess/github.svg)](https://agentmods.dev/commands/hollandkevint/thinkhaven/nfr-assess)

Your own site

<a href="https://agentmods.dev/commands/hollandkevint/thinkhaven/nfr-assess"><img src="https://agentmods.dev/badge/commands/hollandkevint/thinkhaven/nfr-assess/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/hollandkevint/thinkhaven/nfr-assess"><img src="https://agentmods.dev/badge/commands/hollandkevint/thinkhaven/nfr-assess.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,895 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.01895
Opus 5	$0.00000	$0.00948
Sonnet 5	$0.00000	$0.00379
Haiku 4.5	$0.00000	$0.00189

Measured 10d ago against content hash b9c68a16a776, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

nfr-assess scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

nfr-assess — 100% identical, 0 lines differ
nfr-assess — 100% identical, 6 lines differ

.claude/commands/BMad/tasks/nfr-assess.md · 350 lines

How it starts

The opening of the file, as written. The whole thing — 350 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/nfr-assess Task

When this command is used, execute the following task:

nfr-assess

Quick NFR validation focused on the core four: security, performance, reliability, maintainability.

Inputs

required:
  - story_id: '{epic}.{story}' # e.g., "1.3"
  - story_path: `bmad-core/core-config.yaml` for the `devStoryLocation`

optional:
  - architecture_refs: `bmad-core/core-config.yaml` for the `architecture.architectureFile`
  - technical_preferences: `bmad-core/core-config.yaml` for the `technicalPreferences`
  - acceptance_criteria: From story file

Purpose

Assess non-functional requirements for a story and generate:

YAML block for the gate file's nfr_validation section
Brief markdown assessment saved to qa.qaLocation/assessments/{epic}.{story}-nfr-{YYYYMMDD}.md

Process

0. Fail-safe for Missing Inputs

If story_path or story file can't be found:

Still create assessment file with note: "Source story not found"
Set all selected NFRs to CONCERNS with notes: "Target unknown / evidence missing"
Continue with assessment to provide value

1. Elicit Scope

Interactive mode: Ask which NFRs to assess Non-interactive mode: Default to core four (security, performance, reliability, maintainability)

Which NFRs should I assess? (Enter numbers or press Enter for default)
[1] Security (default)
[2] Performance (default)
[3] Reliability (default)
[4] Maintainability (default)
[5] Usability
[6] Compatibility
[7] Portability
[8] Functional Suitability

> [Enter for 1-4]

2. Check for Thresholds

Look for NFR requirements in:

Story acceptance criteria
docs/architecture/*.md files
docs/technical-preferences.md

Interactive mode: Ask for missing thresholds Non-interactive mode: Mark as CONCERNS with "Target unknown"

No performance requirements found. What's your target response time?
> 200ms for API calls

No security requirements found. Required auth method?
> JWT with refresh tokens

Read the full file on GitHub · 350 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 350 lines · 0 tokens per session scan A b9c68a16a776

Subscribe to this mod's changes

nfr-assess is a command published in the GitHub repository hollandkevint/thinkhaven (5 stars, last pushed 11d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,895 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Planning

thinkhaven: Command for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

Copies of this mod

How it starts

/nfr-assess Task

nfr-assess

Inputs

Purpose

Process

0. Fail-safe for Missing Inputs

1. Elicit Scope

2. Check for Thresholds

What this file has done since we first saw it

Other commands, from other repositories

checklist

clarify

specify

analyze

converge

implement