Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/donna-starter --skill specification-compliance-reviewgit clone --depth 1 https://github.com/AtlasOmnia/donna-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/donna-starter/specification-compliance-review)<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/specification-compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/specification-compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 321 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- medium Privilege Escalation · line 184 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.13324 |
| Opus 5 | $0.00017 | $0.06662 |
| Sonnet 5 | $0.00007 | $0.02665 |
| Haiku 4.5 | $0.00003 | $0.01332 |
Grade B, and why
specification-compliance-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
A focused iOS verification should use an actually available simulator destination and then run the complete test target. Record the exact destination and distinguish “unverified due to unavailable destination” from a sou Copies of this mod
1 near-identical copy found in the catalogue:
- specification-compliance-review — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 512 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Specification-Compliance Review
Overview
Use this skill when an implementation is described as partial, passing, or complete and the task is to determine whether it actually satisfies an explicit specification. This is not a generic code review and not a re-run of the test suite. The central question is: does every normative requirement have both a correct implementation path and a meaningful proof?
A green build proves syntax, compilation, and perhaps the tested examples. It does not prove race behavior, cancellation semantics, exact backpressure policy, integration parity, or compliance with explicit non-goals.
Workflow
1. Establish the review baseline
Read, in order:
- The task specification and surrounding plan/release gates.
- Repository guidance (
AGENTS.md, README, project instructions). - The changed files and their callers.
- The tests added or claimed as evidence.
- Git status/diff and recent relevant history.
Create a requirement matrix with one row per normative clause:
| Requirement | Production evidence | Proving test | Execution result | Status |
|---|---|---|---|---|
| Exact behavior | path:lines | test name + fixture | command/output | pass/fail/unknown |
Keep unknown distinct from fail. A test that could not run is not a passing test.
1B. Preflight implementation plans for load-bearing assumptions
When the artifact under review is an implementation plan rather than completed code, identify every external behavior that several downstream tasks assume: server-owned tool execution, plugin loading, request-context propagation, restart/reload ownership, stable host identity, or update/rollback semantics.
Do not let later RED tests encode an unproven API contract. Insert the smallest real-runtime spike before dependent work, capture the exact request/event/context contract, and gate downstream tasks on it. If the plan routes opaque identifiers through model-visible prompt text, require a deterministic metadata/session channel or explicitly stop for the missing platform capability; model copying is not a trusted transport.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/amended-commit-rereview.md 9.0 KB
- references/cross-repository-contract-reconciliation.md 4.3 KB
- references/ios-simulator-triage.md 1.4 KB
- references/late-callback-generation-gating.md 1.3 KB
- references/load-bearing-assumption-spikes.md 2.9 KB
- references/milestone-vs-product-completeness.md 3.1 KB
- references/spec-compliance-review.md 3.1 KB
- references/start-stop-generation-race.md 2.2 KB
- references/typescript-validator-adversarial-review.md 1.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 512 lines · 35 tokens per session scan B b94ed575df2b
specification-compliance-review is a skill published in the GitHub repository AtlasOmnia/donna-starter (111 stars, last pushed 12d ago), licensed MIT. It adds 35 tokens to every session and 13,324 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dx-roaster
Brutally honest developer-experience audit for a GitHub repo. Scores 10 DX dimensions (time-to-first-success, README clarity, visual proof, install, quick-start, docs, examples, community, trust, marketing), writes a shareable roast in the requested tone (brutal/honest/kind), produces a prioritized action plan ranked…
libretranslate-markdown-i18n
Machine-translate Markdown / Obsidian / Quartz content into other languages using a self-hosted LibreTranslate instance, preserving frontmatter, headings, emojis, bold/italic, wikilinks (![[...]]/[[...]]) and internal links. Use whenever a user wants to auto-translate a Markdown vault, Obsidian notes, or a…
awesome-skills-master
Master catalog orchestrator and autonomous installer for AI agents. Use when exploring, cloning, discovering, or installing skills, plugins, or MCP servers from awesome-skills without using interactive CLI tools. Guides environment detection, rule adaptation (.mdc/CLAUDE.md), MCP configuration, and strict author…
readme-template
Standard README template for repos — professional structure with badges, overview, table of contents, features/modules, stack, installation, configuration, tests, security, structure, docs, roadmap, contribute, license, author + RepoActivity sections (Star History, repo stats) + profile GIF footer. Use when creating…
docker-single-port-multi-instance
Consolidate multiple Docker Compose app instances (production / test / demo) behind ONE host port using an nginx reverse proxy that routes by URL path prefix (e.g. /demo). Use when a user wants 'one port, several apps/banks' or a demo reachable simultaneously from the main landing page with its own database.
watermarks-remover
Strip multi-vendor AI provenance marks, invisible Unicode characters (ZWSP, ZWNJ, Bidi, variation selectors), statistical text watermarks, and C2PA/EXIF/XMP metadata from files (PNG, JPEG, PDF, DOCX, MD, TXT).