Borrowing it
Nothing to install: this file belongs to yeisonrestrepo/code-conductor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/yeisonrestrepo/code-conductor/main/.claude/commands/cc-spec.mdgit clone --depth 1 https://github.com/yeisonrestrepo/code-conductorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/yeisonrestrepo/code-conductor/cc-spec)<a href="https://agentmods.dev/commands/yeisonrestrepo/code-conductor/cc-spec"><img src="https://agentmods.dev/badge/commands/yeisonrestrepo/code-conductor/cc-spec/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/yeisonrestrepo/code-conductor/cc-spec"><img src="https://agentmods.dev/badge/commands/yeisonrestrepo/code-conductor/cc-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.01958 |
| Opus 5.5 | $0.00005 | $0.00783 |
| Sonnet 5.5 | $0.00002 | $0.00392 |
| Haiku 4.5 | $0.00001 | $0.00196 |
Grade A, and why
cc-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phase entry - Resume Read
Before doing anything else, restore any stored context for the current commit by running scripts/resume-read.mjs. It resolves the current git hash, prefers a valid DB snapshot (conductor-db get-snapshot), falls back to the .claude/memory/session-snapshot.json handoff file, and prints a RESUME_HIT block on a hit / nothing on a miss. Capture its stdout and its exit code with the canonical per-platform form (each first probes for node and treats its absence as a clean miss, never an error):
- Unix / Git Bash:
if command -v node >/dev/null 2>&1; then resume_out="$(node scripts/resume-read.mjs 2>>.conductor/last-write.log)"; resume_rc=$? else resume_rc=3; resume_out=""; fi - PowerShell:
if (Get-Command node -ErrorAction SilentlyContinue) { $__eap = $ErrorActionPreference; $ErrorActionPreference = 'Continue' if (Test-Path variable:PSNativeCommandUseErrorActionPreference) { $__nap = $PSNativeCommandUseErrorActionPreference; $PSNativeCommandUseErrorActionPreference = $false } try { $resume_out = node scripts/resume-read.mjs 2>> .conductor/last-write.log; $resume_rc = $LASTEXITCODE } catch { $resume_rc = 3; $resume_out = "" } finally { $ErrorActionPreference = $__eap if (Test-Path variable:__nap) { $PSNativeCommandUseErrorActionPreference = $__nap } } } else { $resume_rc = 3; $resume_out = "" }
Branch on resume_rc - only 0 and 4 are meaningful; every other code proceeds fresh:
0→ parse the captured block and adopt it as this phase's starting context, then echo one banner to the user:> Resumed from stored snapshot @ <commit> (phase: <phase>), appending(checkpoint prose available)when the block reportsprose: available. Parsing (the command owns normalization): split on\n; strip a trailing\rfrom every line; drop leading/trailing wholly-blank lines; requirelines[0].trim() === 'RESUME_HIT'(anything else = miss);key: valuelines split on the first': '(both sides trimmed); thepending:block is every subsequent^\s*-\s+line up to the first blank line or EOF, each item trimmed. Unknown keys are ignored. In PowerShell,node …bindsstring[]for multi-line output - normalize with$lines = @($resume_out); a$null/empty capture withresume_rc = 3is a miss.4→ operational halt. Do not run this phase's normal work. Emit exactly:SNAP_INVALID: corrupt handoff at .claude/memory/session-snapshot.json - inspect or remove it, then re-run.and enter standby awaiting user action. The corrupt file is left on disk (the script did not delete it).3or any other code → proceed fresh (clean miss, bypass, degrade, absentnode, or any unexpected runtime code). Ignore the capture.
resume-read.mjs writes its own trace lines to .conductor/last-write.log via appendFileSync; the 2>> redirect above only sinks the incidental exit-4 halt reason away from the UI - it is not the trace channel.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +2 lines 34a989f84a45
- 2mo ago First seen · 139 lines · 12 tokens per session scan A a63c9d20acaa
cc-spec is a command published in the GitHub repository yeisonrestrepo/code-conductor (17 stars, last pushed 2d ago), licensed MIT. It adds 12 tokens to every session and 1,958 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
generate-changelog
Generate a changelog from git history, grouping commits by type and version.
report
Generate a project analytics report covering code quality, velocity, and health metrics.
explain
Explain a code file, function, or concept in clear, structured language.
audit-deps
Audit all project dependencies for vulnerabilities, licensing issues, and maintenance status.
build-image
Build a Docker image with best practices for caching, security, and size optimization.
env-setup
Set up environment configuration files from templates with validation.