spec-fix

spec-fix is a command for coding agents from IgnacioMarin402/spec-flow-plugin. It costs 33 tokens per session (3,775 once invoked), scanned A, original, MIT.

A small defect-fixing workflow that checks a reported problem against the project's written specifications, then sends it through one implementation and testing gate.

In plain words
What is it for?
Use it to investigate whether a defect is in the code or the specification, implement the correction, run the external checks, and record the decision.
Why use it?
It keeps bug fixes focused by removing feature-planning steps while retaining checks that confirm the change matches the specification.

Command

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the spec-flow plugin — 2 skills, 3 commands, 5 agents, 4 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/ignaciomarin402/spec-flow-plugin/spec-fix
Clone the repo
git clone --depth 1 https://github.com/IgnacioMarin402/spec-flow-plugin

Or install spec-flow, the plugin that ships this one along with the rest of its 2 skills, 3 commands, 5 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for spec-fix

README.md
[![agentmods](https://agentmods.dev/badge/commands/ignaciomarin402/spec-flow-plugin/spec-fix.svg)](https://agentmods.dev/commands/ignaciomarin402/spec-flow-plugin/spec-fix)
Your own site
<a href="https://agentmods.dev/commands/ignaciomarin402/spec-flow-plugin/spec-fix"><img src="https://agentmods.dev/badge/commands/ignaciomarin402/spec-flow-plugin/spec-fix.svg" alt="Measured on agentmods" height="20"></a>
Per session 33 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,775 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00033 $0.03775
Opus 5 $0.00016 $0.01887
Sonnet 5 $0.00007 $0.00755
Haiku 4.5 $0.00003 $0.00378

Measured 4d ago against content hash 6894121ccd11, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

spec-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/spec-fix.md · 118 lines

How it starts

The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the Orchestrator for the spec-fix pipeline. Drive the state machine below for the defect in $ARGUMENTS.

This is /spec-flow's smaller sibling, and the difference is deliberate rather than sloppy. A feature is an open question about what the system should do, so it earns a spec, a plan, a review and a milestone map. A defect is a closed question: the system already claims a behaviour and something disagrees with the claim. The whole job is finding out which side is wrong — and that is the triage in step 1, not a planning exercise. So this flow drops the planner and the reviewer entirely, and a fix costs one implementer pass instead of a plan, a review and N milestones.

What it does not drop: the external gate, the spec-trace check, and the archived record of what was decided. Lighter means fewer agents, never less proof.

Phase discipline — reuse the vocabulary, never extend it

You manage phase via .claude/state/phase, exactly as /spec-flow does, and you may only write the values that flow already uses: spec, implement, blocked, done, idle.

This is not a style preference. Every enforcement hook decides whether it is armed by matching that file against a closed set of values — the gate, the write-time linter and the whole-repo command deny all run only on implement, the Opus budget and preflight stand down on idle|done, session-start resets any stale run phase. Each one falls through to "not our business" on a value it does not recognise. So inventing a phase like triage or fix would run this flow with the gate, the write-time linter, the whole-repo command deny and the Opus budget all disarmed at once, and nothing would say so — code written with the gate off looks exactly like code that passed it.

Triage runs under spec (it is spec work: deciding what happens to specs/). Everything from the work order onward runs under implement.

arm-gate and phase-guard back you up here the same way they back up /spec-flow: engaging the implementer arms the gate whether or not you wrote the phase, and done is denied while spec-trace, any extra check the project declares, or an unarchived specflow/<SLUG>/ say otherwise. They are the backstop, not the protocol — keep writing every phase yourself.

Read the full file on GitHub · 118 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 118 lines · 33 tokens per session scan A 6894121ccd11

Subscribe to this mod's changes

spec-fix is a command published in the GitHub repository IgnacioMarin402/spec-flow-plugin (2 stars, last pushed 2d ago), licensed MIT. It adds 33 tokens to every session and 3,775 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.