implement-spec

An autonomous workflow for implementing an approved software specification in a local repository or cloud coding environment.

In plain words
What is it for?
Use it to read the project guidance, plan and implement the specified changes, run the required checks, and work through the defined implementation phases.
Why use it?
It keeps implementation tied to the written specification and project rules, reducing unrequested features, guesses, and incomplete validation.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/a16z/jolt/implement-spec
Any agent
npx skills add a16z/jolt --skill implement-spec
Clone the repo
git clone --depth 1 https://github.com/a16z/jolt

Made for: Claude Code, Codex.

Per session 17 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,334 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00017 $0.01334
Opus 5 $0.00009 $0.00667
Sonnet 5 $0.00003 $0.00267
Haiku 4.5 $0.00002 $0.00133

Measured 2d ago against content hash e95ae54ad63c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

implement-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/implement-spec/SKILL.md · 118 lines

How it starts

The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.

This skill runs locally or in Claude Code cloud (claude.ai/code) — NOT in CI. It needs write access to the repo to create commits and push to the PR branch.

<Execution_Policy>

  • The spec is the source of truth. Implement what it says, not more.
  • Read CLAUDE.md for project conventions, testing requirements, and architecture.
  • Each phase must complete before the next begins.
  • Parallel execution within phases where possible.
  • If something in the spec is ambiguous, post a PR comment rather than guessing.
  • Do not add features, refactor code, or make improvements beyond the spec.
  • If the spec lacks the claude-spec-approved label, warn that it hasn't been analyzed yet (implementation from an unanalyzed spec risks rework), but proceed if the user insists. </Execution_Policy>

Phase 1: Plan

  1. Read the spec: Find the specs/*.md file in this PR (exclude TEMPLATE.md). If a path is provided in {{ARGUMENTS}}, use that.
  2. Read CLAUDE.md: Understand architecture, conventions, testing requirements.
  3. Read jolt-eval/README.md: Understand the eval framework — the spec's Intent → Invariants and Evaluation → Performance sections may reference it.
  4. Explore relevant code: Use explore agents to understand the modules, types, and patterns the implementation will touch.
  5. Extract evals: Scan the spec's Intent → Invariants and Evaluation → Performance sections for jolt-eval references and list:
    • New invariants to add → each becomes a /new-invariant <name> subtask.
    • New objectives to add → each becomes a /new-objective <name> subtask.
    • Existing invariants/objectives that need to be changed.
  6. Create implementation plan: Based on the spec's Intent and Execution sections, determine:
    • Files to create, modify, or remove
    • Order of changes (dependencies first)
    • How existing patterns and abstractions should be extended
    • Which tasks can run in parallel vs. sequential
  7. Post the plan as a PR comment for visibility:
**Implementation plan for: {spec title}**

**Changes:**
1. {file/module} — {what changes and why}
2. ...

**Order:** {dependency chain}
**Parallel tasks:** {which can run simultaneously}
**Estimated scope:** {number of files, rough line count}

Read the full file on GitHub · 118 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 118 lines · 17 tokens per session scan A e95ae54ad63c

Subscribe to this mod's changes

implement-spec is a skill published in the GitHub repository a16z/jolt (1,020 stars, last pushed 2d ago), licensed Apache-2.0. It adds 17 tokens to every session and 1,334 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

linea-dependency-maintenance

Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions, release-age policies, audits, CI validation, Dependabot boundaries, PRs, and GitHub tracking issues. Use whenever the user…

Consensys/doc.linea · 113 tokens

pr-content-review

Review docs.linea.build content for editorial compliance (voice, terminology, naming, formatting, frontmatter) before opening or merging a pull request. Use before submitting a PR, when reviewing someone else's draft, or when asked to audit existing pages.

Consensys/doc.linea · 53 tokens

starknet-js

Use when writing or debugging JavaScript/TypeScript that interacts with Starknet through the starknet.js SDK — building Call objects or calldata, encoding/decoding Cairo types (felt252, u256, structs, arrays, spans, ByteArray, Option/Result/custom enums), or working with contracts, accounts, providers, transactions…

starknet-io/starknet.js · 79 tokens

EMILIA Trust Verification

Verify the authenticity of AI-agent authorization receipts and human-device signoffs. Use this whenever a user shares a "trust receipt", an "authorization receipt", a "signoff", or WebAuthn/passkey approval evidence and asks whether it is valid, genuine, or tampered with. Pairs with the public EMILIA Protocol MCP…

emiliaprotocol/emilia-protocol · 94 tokens

Cryptographic Analysis & Assessment

SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code.

Masriyan/Claude-Code-CyberSecurity-Skill · 30 tokens

author-doc-page

Scaffold or draft a new docs.linea.build page to editorial standards. Use when creating a new page, writing a first draft, or helping a contributor who isn't a professional writer produce content that meets the documentation team's expectations.

Consensys/doc.linea · 49 tokens