A workflow for closing a planned unit of work after its tasks are complete. It checks the task ledger, runs the project's verification commands, and records whether the work passed.

Use it to verify and formally complete an increment, release your task claims, and record a reason when closing without a successful verification.

It prevents unfinished tasks or failing tests from being treated as complete. Optional review adds another check for user-facing changes.

done — Skill for Claude Code by anton-abyzov

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add anton-abyzov/specweave --skill done

Clone the repo

git clone --depth 1 https://github.com/anton-abyzov/specweave

Made for: Claude Code.

Or install sw, the plugin that ships this one along with the rest of its 10 skills, 1 agent, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/anton-abyzov/specweave/done.svg)](https://agentmods.dev/skills/anton-abyzov/specweave/done)

Your own site

<a href="https://agentmods.dev/skills/anton-abyzov/specweave/done"><img src="https://agentmods.dev/badge/skills/anton-abyzov/specweave/done.svg" alt="Measured on agentmods" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 721 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Tool Misuse · line 35
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
medium Tool Misuse · line 35
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00721
Opus 5	$0.00000	$0.00360
Sonnet 5	$0.00000	$0.00144
Haiku 4.5	$0.00000	$0.00072

Measured 3d ago against content hash cfe09f264af5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

done scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/specweave/skills/done/SKILL.md · 42 lines

How it starts

The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Close Increment

Closure = verify → optional review → specweave complete. The only hard gate is reports/verify.json with ok: true. Grill / judge / rubric reports are optional evidence and never block.

Usage

sw:done <increment-id>                    # normal closure
sw:done <increment-id> --reason "<why>"   # close without a green verify (recorded as metadata.closeReason)

Steps

Ledger check: specweave task list <id>. Every task must be done or skipped. Open/claimed tasks → go back to sw:do (or task skip … --reason "<why>"). Release your own claims: specweave task release --all-mine.
Verify: specweave verify <id>. Runs testing.commands from config (else npm run test|lint|build, cargo test, pytest, go test ./...), writes reports/verify.md + reports/verify.json. Non-zero exit → fix, re-run. Do not proceed on red without a --reason from the user.
Review (recommended for anything user-facing, optional otherwise): invoke Skill({ skill: "sw:review" }) — fresh context, adversarial, findings cite path:line, written to reports/review.md. Fix critical/high findings, re-run step 2 if code changed.
Docs touched? If the increment changed commands, config, or user-facing behaviour, update README/CHANGELOG/CLAUDE.md ## Commands in the same commit. Living docs sync only if livingDocs is enabled in config (specweave docs sync <id>).
Complete: Bash({ command: "specweave complete <id> --yes" }). The CLI refuses when verify.json is missing or not ok unless --reason "<text>" is given; it prints a notice when reports/review.md is absent; it sets status: completed and syncs GitHub/Jira/ADO when configured. Never edit metadata.json status by hand.
Handoff: if work continues elsewhere (follow-ups, another increment), sw:handoff.

Report in one paragraph: verify result, review verdict (or "skipped"), commit sha(s), anything deferred.

Rules

Never ask "should I close?" — closure follows automatically when tasks are done; the user can re-open.
--skip-validation exists for emergencies only; prefer --reason so the reason is recorded.
Multi-agent sessions (sw:team): only the lead runs sw:done, after every agent has released and handed off.
Failed sync after completion: specweave sync push <id> retries; closure itself already succeeded.

Read the full file on GitHub · 42 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 42 lines · 0 tokens per session scan A cfe09f264af5

Subscribe to this mod's changes

done is a skill published in the GitHub repository anton-abyzov/specweave (160 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 721 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Project management Testing ai azure-devops claude cli developer-tools documentation

genie-orca-review

Independent, read-only review of a group, a wish, or a PR on Orca — SHIP / FIX-FIRST / BLOCKED with severity-tagged findings. Council and retro are this skill with a different input.

automagik-dev/genie · 50 tokens

linear-graphql-skill

Operate Linear workspace issues, projects, and teams through Linear GraphQL API using UXC. Use when tasks require querying or creating issues, managing projects, or interacting with Linear workflow. Supports both Personal API Key and OAuth authentication.

holon-run/uxc · 51 tokens

ext-php-rs-bindings

ext-php-rs conventions for building PHP 8.2+ native extensions from a Rust core: phpclass/phpfunction macros, Zval conversion, PhpException mapping, php.ini loading, and PHPUnit testing. Load when generating or reviewing ext-php-rs PHP bindings for a Rust library.

Goldziher/ai-rulez · 68 tokens

go-conventions

Go code conventions covering Effective Go, error wrapping, golangci-lint, govulncheck, table-driven tests, interfaces, context usage, modules, and concurrency. Load when writing or reviewing Go code.

Goldziher/ai-rulez · 47 tokens

bindings

Cross-language binding architecture rules: bindings as minimal glue, canonical API surface ordering (core, ABI, language), per-language test suites in CI, generated-code discipline, and error/async boundary preservation. Load when designing or reviewing polyglot language bindings for a shared core.

Goldziher/ai-rulez · 57 tokens

ralphctl-test-driven-development

Execute-phase skill — write the failing test before the code that makes it pass; for bug fixes, this is the reproduction test itself. Use for any logic change, bug fix, or behavioural modification; for the full root-cause triage pipeline around an unexpected failure, see ralphctl-debugging-and-error-recovery.

lukas-grigis/ralphctl · 72 tokens