Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/xiaolai/nlpm/spec-syncgit clone --depth 1 https://github.com/xiaolai/nlpmWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.01510 |
| Opus 5 | $0.00018 | $0.00755 |
| Sonnet 5 | $0.00007 | $0.00302 |
| Haiku 4.5 | $0.00004 | $0.00151 |
Grade A, and why
spec-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
User Input
$ARGUMENTS
Workflow
A pipeline that keeps nlpm's tool overlays current with the upstream specs they document. The web research fans out to spec-researcher agents (one per tool, in parallel); the high-judgment editing stays here in the reviewable main thread.
This command never commits, pushes, or touches the marketplace. It edits overlay skills and reports the remaining release steps.
Step 1: Parse target
| Input | Overlays to sync |
|---|---|
(empty) or all |
all three |
claude |
skills/nlpm/conventions-claude/SKILL.md |
codex |
skills/nlpm/conventions-codex/SKILL.md |
antigravity |
skills/nlpm/conventions-antigravity/SKILL.md |
Resolve today's date with date +%Y-%m-%d (passed to the agents and used for the "Refreshed" note). Confirm each selected overlay file exists; if one is missing, report "Overlay not found: {path}" and continue with the rest.
Step 2: Research (parallel)
Dispatch one spec-researcher agent per selected overlay, all in a single message so they run concurrently. Pass each agent:
- the tool name (
claude/codex/antigravity) - the overlay path and its full current content
- today's date
Each agent fetches the overlay's declared authoritative sources (plus the docs index and, for Codex, GitHub releases), diffs them, and returns a structured gap report tagged [FIX | REMOVE | ADD | CONFIRM | RESOLVED] with a confidence section.
Collect every report. If an agent returns nothing, note "Research failed for {tool} — re-run /nlpm:spec-sync {tool}" and continue.
Step 3: Present the diagnosis
Show the consolidated gap report, grouped by tool, corrections first (FIX / REMOVE / RESOLVED), then additive (ADD), then a confidence summary. This is the human-reviewable diff before any file changes.
Step 4: Apply corrections
For each overlay, edit the SKILL.md to absorb its report:
- Apply every
FIX,REMOVE,RESOLVED+(uncertainty resolved — the thing exists), andRESOLVED-(uncertainty resolved — the thing is confirmed removed/absent against a first-party source) finding, plus everyADDthe agent rated structural (high-confidence). - Defer, do not guess: skip anything in the agent's confidence notes —
verify-tag(a version/date specific that needs pinning) andnot-found(a claim the agent could not confirm against any source). Note the distinction fromRESOLVED-: aRESOLVED-is a confirmed absence and gets applied; a barenot-foundis unconfirmed and gets deferred. List deferred items in the final report rather than writing an unverified fact into the overlay. - When correcting a fact, leave a brief inline note of what the old value was and the refresh date (matches the existing overlay style, e.g. "
magentais NOT valid (old list had it; corrected {date})") — this keeps the overlay self-documenting and prevents a future pass from regressing it. - Refresh the overlay frontmatter: bump
version:(patch if corrections-only, minor if additive sections were added) and update the "Refreshed {date}" clause indescription:.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 109 lines · 36 tokens per session scan A 85e03de81bbc
spec-sync is a command published in the GitHub repository xiaolai/nlpm (133 stars, last pushed 2d ago), licensed ISC. It adds 36 tokens to every session and 1,510 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.
implement
Execute the implementation plan by processing and executing all tasks defined in tasks.md.