Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arrrrny/zuraffa --skill speckit-bug-prgit clone --depth 1 https://github.com/arrrrny/zuraffaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arrrrny/zuraffa/speckit-bug-pr)<a href="https://agentmods.dev/skills/arrrrny/zuraffa/speckit-bug-pr"><img src="https://agentmods.dev/badge/skills/arrrrny/zuraffa/speckit-bug-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arrrrny/zuraffa/speckit-bug-pr"><img src="https://agentmods.dev/badge/skills/arrrrny/zuraffa/speckit-bug-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01480 |
| Opus 5.5 | $0.00008 | $0.00592 |
| Sonnet 5.5 | $0.00004 | $0.00296 |
| Haiku 4.5 | $0.00002 | $0.00148 |
Grade A, and why
speckit-bug-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Pr Skill
Open Fix Pull Request
Open a GitHub pull request for the fix recorded by /speckit-bug-fix. This command reads .specify/bugs/<slug>/fix.md (and issue.md if the bug was reported) and creates a PR via the gh CLI from the current branch, linking the issue. If gh or a GitHub remote is unavailable, it writes a ready-to-paste PR draft instead.
This command is the natural follow-up when
bug.fixwas run with--branch/--worktree: the current branch is the fix branch (e.g.fix/<slug>) and the PR opens from it.
User Input
$ARGUMENTS
Accept any of:
slug=<bug-slug>or--slug <bug-slug>or a bare slug-like token.- A path that contains the slug (e.g.
.specify/bugs/login-timeout/). - Nothing — fall back to context (see Slug Resolution).
Slug Resolution
Resolve BUG_SLUG in this order, stopping at the first match:
- Explicit user input — a slug passed in
$ARGUMENTS(any of the forms above). - Conversation context — if the current session has just run
/speckit-bug-fix(orbug.issue), the slug it reported is the working slug. Reuse it without re-prompting. - Single candidate on disk — list
.specify/bugs/*/fix.md. If exactly one bug has afix.md, use it. - Disambiguate:
- Interactive mode: ask the user which bug to open a PR for and list the candidates.
- Automated mode: stop with an error listing the candidates. Do not guess.
Once resolved, set BUG_SLUG and BUG_DIR = .specify/bugs/<BUG_SLUG>.
Prerequisites
BUG_DIR/fix.mdMUST exist. If it does not, stop and instruct the user to run/speckit-bug-fixfirst.- Confirm the current branch is the fix branch (created by
bug.fix --branch, or whatever branch holds the change). If the working tree is onmain/masterwith uncommitted changes, warn the user and ask which branch to open the PR from before continuing. - Detect GitHub context (same as
bug.issue):git rev-parse --is-inside-work-treeandgit config --get remote.origin.urlto parseowner/repo; only proceed live when the remote isgithub.com.command -v ghandgh auth statusto confirm the CLI and auth.- If
gh/GitHub remote/auth is unavailable, write a draft (see Graceful Degradation).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +101 lines · +21 tokens per session e4d36b685cc3
- 1mo ago Changed · -98 lines · -21 tokens per session 716476ac48d1
- 1mo ago First seen · 99 lines · 21 tokens per session scan A 96b10cbbefda
speckit-bug-pr is a skill published in the GitHub repository arrrrny/zuraffa (5 stars, last pushed yesterday), licensed MIT. It adds 21 tokens to every session and 1,480 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
he-ship
Deliver a verified build through a task branch and PR, check the intended remote result, and clean up the completed task safely. Use for PR creation, shipping, merging or release/deployment requests; skip planning, implementation and review-only work.
code-review
Review PR, branch, commit or working-tree changes for concrete defects and fidelity to intended behavior. Also use when explicitly asked to independently challenge a prepared plan, diagnosis or verification claim.
repo-hygiene
Use when the scheduled repo-hygiene workflow runs from GitHub Actions (or an operator dry-run) to scan the repository for small, certain docs/test/code hygiene issues and fix them as one batched branch.
gh-skill
Manage agent skills with gh skill. Use this skill to discover, preview, install, update, and publish Agent Skills so an agent can self-manage the skills available in its environment.
atmos-hooks
Atmos hooks: lifecycle events, hook kinds, command/store/git/security hooks, step/steps hooks, when: conditions, scoping and overrides, toolchain integration, --skip-hooks, and Atmos Pro/local output.
conventional-commit
Conventional Commit - Generate Conventional Commits 1.0.0 compliant messages. MANDATORY for all git commits. Invoke when user says 'commit', 'commit this', or asks to commit code.