Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ronronner02/codepilot-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/ronronner02/codepilot-agent/spec-work)<a href="https://agentmods.dev/commands/ronronner02/codepilot-agent/spec-work"><img src="https://agentmods.dev/badge/commands/ronronner02/codepilot-agent/spec-work/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/ronronner02/codepilot-agent/spec-work"><img src="https://agentmods.dev/badge/commands/ronronner02/codepilot-agent/spec-work.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00007 | $0.07706 |
| Opus 5.5 | $0.00003 | $0.03082 |
| Sonnet 5.5 | $0.00001 | $0.01541 |
| Haiku 4.5 | $0.00001 | $0.00771 |
Grade A, and why
spec-work scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Command support root: .claude/spec-first/workflows/spec-work. Treat it as the loaded skill directory whenever this inlined workflow refers to SKILL_DIR or the directory containing SKILL.md.
Work Execution Command
Execute work efficiently while maintaining quality and finishing features.
Introduction
This command takes a work document (plan or specification) or a bare prompt describing the work, and executes it systematically. The focus is on shipping complete features by understanding requirements quickly, following existing patterns, and maintaining quality throughout.
Workflow Contract Summary
- Inputs: settled implementation-ready code plan, validated task pack, explicit knowledge-work plan, or concrete bounded implementation prompt.
- Outputs: scoped source changes, task/unit evidence, required review/residual posture, structured verification closeout, and an authorization-aware handoff. A task pack remains derived; its source plan owns scope/lifecycle.
- Hard exits: unresolved target repo/dirty overlap/source owner, requirements-only or invalid unified metadata, task-pack/source-plan drift, scope-changing acceptance/architecture/provider/source-runtime discovery, failed required review/verification, or missing mutation/commit/landing authority for the requested exit.
- Ownership: scripts prepare deterministic facts; LLMs judge semantic fit. Canonical source is modified; generated runtime mirrors are never source fixes. Local mutation, commit, landing, lifecycle, and durable evidence are separate exits.
- Consumers:
spec-code-review, caller-owned LFG/goal flows, commit/PR/release workflows,spec-compound, and human reviewers.
Reference Trigger Map
| Reference | Trigger | If unread/unavailable |
|---|---|---|
| Work intake and task pack | Shallow metadata says type: task-pack. |
Do not execute the pack; return validation/regeneration handoff. |
| Non-code execution | Metadata says execution: knowledge-work. |
Do not enter code/shipping lifecycle; report the missing production route. |
| Execution strategy | Before first write/test/review-fix, task tracking, worker dispatch, commit, or landing. | Lock repo/source/dirty facts inline; use inline/serial; no commit or landing claim. |
| Execution engines | A structured plan/task pack or explicit request makes goal/dynamic/worker engine selection relevant. | Use inline; do not infer a callable non-default engine. |
| Feedback and tests | Before behavior mutation, test design, or verification coverage claim. | Run the narrowest known check and do not claim system-wide coverage. |
| Implementation quality | Before durable-surface mutation or phase-boundary simplification. | Do not add a new durable surface; return to the plan owner if current source fit is unresolved. |
| Shipping workflow | All implementation tasks are accounted for and quality/closeout begins. | No completion/lifecycle/commit/landing claim. |
| Review findings followup | A completed review returned actionable caller-owned findings. | Preserve in-band findings/limitations; do not rerun or silently drop them. |
| Tracker defer | Residual gate explicitly selects external tracker deferral. | Return structured no_sink; do not lose residuals or infer external authority. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 293 lines · 7 tokens per session scan A b30721d423eb
spec-work is a command published in the GitHub repository ronronner02/codepilot-agent (0 stars, last pushed 1mo ago), licensed MIT. It adds 7 tokens to every session and 7,706 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
PyTest.GateKeeper
You are a Senior QA Automation Engineer with deep expertise in Python testing and the pytest framework.
acos
The single command you need. ACOS auto-routes everything.
acos-checkpoint
Create checkpoints before risky operations. Rollback if things go wrong.
attune
AI-powered developer workflows with Socratic discovery.
push
This command will push new design file into the given jira ticket With this command the user will provide arguments.
agent
Create and manage custom AI agents.