Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/voro6yov/spec-driven-development/claude-mdgit clone --depth 1 https://github.com/voro6yov/spec-driven-developmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/voro6yov/spec-driven-development/claude-md)<a href="https://agentmods.dev/instructions/voro6yov/spec-driven-development/claude-md"><img src="https://agentmods.dev/badge/instructions/voro6yov/spec-driven-development/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04500 | $0.04500 |
| Opus 5 | $0.02250 | $0.02250 |
| Sonnet 5 | $0.00900 | $0.00900 |
| Haiku 4.5 | $0.00450 | $0.00450 |
Grade B, and why
spec-driven-development CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **The copied reference modules, `spec-core:modules`** — the umbrella home of the **runtime-contract Python modules** the spec pipeline copies verbatim into the target repo during init/scaffold: `shared/` (domain primit How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Repository purpose
This is a Claude Code plugin marketplace (.claude-plugin/marketplace.json) for spec-driven development plugins, e.g.:
plugins/domain-spec— generates DDD class specs from a Mermaid class diagram, then implements the domain package and its unit tests
There is no application code, no build step, and no test suite. Artifacts are Markdown — skills, agent definitions, and plugin manifests — that are loaded by Claude Code at runtime.
Plugin layout
Each plugin under plugins/<name>/ has:
.claude-plugin/plugin.json— plugin manifest withversion(bump on user-visible changes)agents/*.md— single-purpose subagents with frontmatter (name,description,tools, optionalmodel)skills/<skill>/SKILL.md— reusable skills; umbrella orchestrator skills (e.g.generate-domain) chain agent orchestrators (specs-generator,code-generator), which in turn coordinate the worker agents
plugins/spec-core/skills/modules/ contains Python reference modules (Entity, ValueObject, guards, the persistence context packages, the REST serializers, etc.) that the generated code imports — not source for this repo to test, but the runtime contract that the implementers/scaffolders target and copy verbatim into the target repo. They are homed under the spec-core:modules umbrella skill; see the spec-core section below for the resolution mechanism.
Shared conventions (spec-core)
plugins/spec-core is a base plugin that owns conventions and agents shared across every spec plugin. It ships:
- One skill,
spec-core:naming-conventions— the single source of truth for the aggregate stem, diagram filenames, per-plugin sibling-folder layout, path-resolution tables, and the numbered Path-hygiene rules. The five spec plugins (domain-spec,application-spec,persistence-spec,rest-api-spec,messaging-spec) andmodel-diagramsall reference it asspec-core:naming-conventions— in agent frontmatterskills:lists and in prose — rather than each carrying their own copy. - One agent,
spec-core:target-locations-finder— the single shared resolver of where each layer's code lives in the target repo. It takes<layer> [<domain_diagram>](layer∈domain/application/persistence/rest-api/messaging; thedomainlayer also takes the diagram, to derive the aggregate sub-package) and emits the layer's category→path→status table. It replaced five near-identical per-plugintarget-locations-finderagents (the skeleton — repo/package resolution, existence check, report shape — was byte-identical; only the per-layer path set and the domain diagram-derivation branch differed). Every orchestrator (each plugin'scode-generatoragent, theinit-*skills, and each plugin'supdate-codeskill — which resolves its own layer) invokes it with the layer token; downstream worker agents still receive the report verbatim as<locations_report_text>and must not re-run it. When consolidating another per-plugin agent clone, home it here the same way. - One agent,
spec-core:project-package-finder— the single shared resolver of the repo'ssrc/root and its single project package, emitting aRepo/Src/Package/Package Dir/Tests Dirtable. It is the shared Step 1 every layer initializer delegates to:/init-domain,/init-persistence,/application-spec:init-application,/rest-api-spec:init-rest-api, and/messaging-spec:init-messagingeach invoke@spec-core:project-package-finder(passing their own command label, used only in its failure messages), parse the report for<repo>/<src>/<pkg>, then bind their own layer-specific derived paths from those. This replaced ~five byte-identical copies of the package-discovery preamble (the exact code CLAUDE.md flags as historically bug-prone — "past bugs came from misderiving the project root").@spec-core:target-locations-finderperforms the same resolution as its own Step 1 but keeps an inline copy rather than delegating — it cannot invoke another agent (noAgenttool) and must stay self-contained for its many orchestrator callers; the two carry a sync note and must be changed together if the resolution rule ever changes. - The cross-layer update orchestrator,
spec-core:update-specs— the single home of the cross-plugin spec-update cascade./spec-core:update-specs <domain_diagram>runs each layer's own/…-spec:update-specsskill in dependency order — domain → {persistence ∥ application} → {rest-api ∥ messaging} — probing each layer's spec artifact on disk and skipping any layer that was never generated (graceful degradation, no hard crash). Each per-layerupdate-specsis now a pure single-plugin updater: it detects its own deltas, regenerates its own specs, emits its ownupdates.md, and invokes no other plugin. This replaced the old in-skill chaining wheredomain-spec:update-specsfanned out to persistence/application from its own tail (Step 10) andapplication-spec:update-specsre-cascaded to rest-api/messaging from its own tail (Step 9) — a control coupling that made the innermost layer (domain-spec) hard-depend on the four outer layers (dependency pointing up the stack; theSkillcall failed hard on a missing leaf plugin). Homing the fan-out inspec-coreinverts that the right way. The data coupling is unchanged: rest-api/messaging still read the<stem>.application/{commands,queries,ops}-updates.mddetector reports application produces, and the orchestrator passes--detectors-freshto the rest-api/messaging wave (decided by disk-presence of those reports, not by application's outcome).domain-specandapplication-specupdate-specsconsequently droppedSkillfromallowed-tools; the leaves never had it. - The cross-layer code-update orchestrator,
spec-core:update-code— the execution analog ofspec-core:update-specsand the single home of the cross-plugin code-update cascade./spec-core:update-code <domain_diagram> [--review]runs each layer's own/…-spec:update-codeskill in dependency order — domain → {persistence ∥ application} → {rest-api ∥ messaging} — probing each layer's spec presence marker (the same markersupdate-specsuses) and skipping any layer never generated. Each per-layerupdate-codeis a pure single-plugin updater: it resolves its own target locations, runs its owngather → (per-layer risk gate) → implement → reviewflow over its owncode-brief-writer/code-change-writer/code-review-writeragents (persistence also runsquery-code-change-writer), applies its own edits, prints its own one-line outcome, and invokes no other plugin. This replaced the old monolithicdomain-spec:update-code, which hard-coded all five layers, every per-plugin agent name, and the dependency waves in a single skill rooted in the innermost layer. One deliberate divergence from the spec cascade: code layers couple on on-disk source (a downstream change-writer reads settled upstream source), so an upstream layer that does not settle — an agent hard-fail or a declined per-layer risk gate — skips its dependent downstream waves (domain ⇒ all; application ⇒ rest-api/messaging; persistence ⇒ none). The two cross-cutting features of the old monolith degrade by design (Fork 1, chosen 2026-06-14): the risk checkpoint is now per-layer (there is no global pre-edit veto once edits land wave-by-wave), and there is no consolidated summary table — only the one-line topology summary, exactly likespec-core:update-specs. Per-layer skills carryallowed-tools: Read, Bash, Agent, AskUserQuestion; the orchestrator carriesRead, Bash, Skill. Single-layer code updates are now possible standalone (/persistence-spec:update-code <diagram>), which the monolith could not do. - The cross-layer update-report schemas,
spec-core:update-reports— the umbrella home of the three detector report schemas the spec-update cascade produces and consumes across plugin boundaries: the domain-diagram diff (domain/index.md, produced bydomain-spec:updates-detector), the application-service-axis diff (application/index.md, produced bycommands-/queries-updates-detector), and the ops-service diff (ops/index.md, produced byops-updates-detector). Each schema is a supporting file Read by path; only the umbrellaSKILL.mdindex auto-loads. Producers frontmatter-loadspec-core:update-reportsand Read<update_reports_dir>/<layer>/index.md; cross-layer consumers resolve the same umbrella — persistence-spec'scommand-repo-spec-migrations-appender+query-code-change-writerfrontmatter-load it and Readdomain/index.md(the load-bearing edge that pre-2026-06-14 forced a dual-homeddomain-spec:updates-report-template), while the application/rest-api/messaging update writers cite it as provenance. This homes the schemas next to theupdate-specsorchestrator that drives them and retired the last dual-homed twin. Scope is deliberate: only the cross-consumed detector schemas moved. Each layer's own code-update report (<stem>.{persistence,application,rest-api,messaging}/updates.md— the## Affected Artifactsdispatch schema itsupdate-codeflow consumes) stays a plugin-private supporting file under that plugin's ownpatternsumbrella; those are the candidates to follow if the cross-layer code-update workflow is later consolidated the same way.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 63 lines · 4,500 tokens per session scan B 5b4e539be00f
spec-driven-development CLAUDE.md is an instructions file published in the GitHub repository voro6yov/spec-driven-development (4 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 4,500 tokens to every session, about $0.0225 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
next.js AGENTS.md
Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.