Borrowing it
Nothing to install: this file belongs to AlphaBitCore/nexus-gateway. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/AlphaBitCore/nexus-gateway/main/.claude/skills/spec-writing/SKILL.mdgit clone --depth 1 https://github.com/AlphaBitCore/nexus-gatewayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alphabitcore/nexus-gateway/spec-writing)<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/spec-writing"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/spec-writing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/spec-writing"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/spec-writing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.04029 |
| Opus 5 | $0.00034 | $0.02014 |
| Sonnet 5 | $0.00014 | $0.00806 |
| Haiku 4.5 | $0.00007 | $0.00403 |
Grade A, and why
spec-writing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 487 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spec-Driven Development (SDD)
SDD is a development discipline where specifications are written and agreed upon before any implementation begins. Specs serve as the control document for both humans and AI agents: they define what must be built, what must not happen, and how success is judged.
Core principle: Write for two readers simultaneously — a software practitioner and an AI coding agent. If either has to guess, the spec is not ready.
Invocation Protocol
When this skill is triggered, follow these steps in order. Do not write code or architecture before completing Phase 1.
Step 1 — Clarify intent
Ask the user:
- What is the feature or change in one sentence?
- Is this a new feature, a change to existing behavior, or a bug fix?
- Is there a ticket ID, Jira/Linear issue, or slug to use for file naming?
- Is there an existing spec or plan already started? (Check
.plans/directory)
Once you have a ticket ID or slug, scaffold the plan directory:
.claude/skills/spec-writing/scripts/new.sh <ticket-id>
This copies blank templates into .plans/<ticket-id>/ and ensures .plans/ is in .gitignore.
Step 2 — Gather context (brownfield projects)
Before writing a single requirement, read the codebase:
- Identify files, modules, and interfaces the feature will touch
- Note architectural patterns, naming conventions, and constraints already in use
- Read any existing relevant specs, plans, or ADRs
- Summarize findings to the user before proceeding
Step 3 — Ask elicitation questions
Use the Key Questions bank below. Pick the most relevant 4–6; do not ask all at once. Present as a numbered list and wait for answers before drafting the spec.
Step 4 — Draft the spec
Write A1-spec.md using the Specification Template. Present the full draft to the user.
Step 5 — Approval gate
Stop. Do not proceed to Phase 2 until the user explicitly approves the spec. Say: "Spec draft complete. Please review A1-spec.md and say 'approved' or provide feedback."
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 487 lines · 69 tokens per session scan A a58479773fbd
spec-writing is a skill published in the GitHub repository AlphaBitCore/nexus-gateway (23 stars, last pushed 7d ago), licensed Apache-2.0. It adds 69 tokens to every session and 4,029 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
defenseclaw-ops
Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails.
soc2-expert
Expert in SOC 2 compliance, trust service criteria, audit preparation, controls implementation, and security frameworks. Use when the user mentions compliance, audit, trust services, AICPA, controls, or security framework, or when the task involves Trust Service Criteria, SOC 2 Types, Security Common Criteria, or…
audit-expert
Expert-level security auditing, compliance, code review, and vulnerability assessment. Use when the user mentions compliance, security review, code review, vulnerability assessment, SOC 2, or GDPR, or when the task involves Audit Types, Audit Frameworks, Audit Process, or Authentication Review.
audit
A guide to Linux security auditing, which records selected system and user actions for investigation and compliance checks. It uses auditd, Linux's system auditing service.
ai-identity-platform
Structured identity management for AI agent fleets — define, govern, and audit agent personas at scale.
omni-cli-tools
Manage CLI tool integrations exposed via the API. List, configure, and invoke CLI tool plugins that extend OmniRoute's automation surface.