Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/hermes-custom-pack --skill specification-compliance-reviewgit clone --depth 1 https://github.com/AtlasOmnia/hermes-custom-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review)<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/specification-compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/specification-compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.13324 |
| Opus 5.5 | $0.00014 | $0.05330 |
| Sonnet 5.5 | $0.00007 | $0.02665 |
| Haiku 4.5 | $0.00003 | $0.01332 |
Grade B, and why
specification-compliance-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
A focused iOS verification should use an actually available simulator destination and then run the complete test target. Record the exact destination and distinguish “unverified due to unavailable destination” from a sou This is a copy
100% identical to specification-compliance-review — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 512 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Specification-Compliance Review
Overview
Use this skill when an implementation is described as partial, passing, or complete and the task is to determine whether it actually satisfies an explicit specification. This is not a generic code review and not a re-run of the test suite. The central question is: does every normative requirement have both a correct implementation path and a meaningful proof?
A green build proves syntax, compilation, and perhaps the tested examples. It does not prove race behavior, cancellation semantics, exact backpressure policy, integration parity, or compliance with explicit non-goals.
Workflow
1. Establish the review baseline
Read, in order:
- The task specification and surrounding plan/release gates.
- Repository guidance (
AGENTS.md, README, project instructions). - The changed files and their callers.
- The tests added or claimed as evidence.
- Git status/diff and recent relevant history.
Create a requirement matrix with one row per normative clause:
| Requirement | Production evidence | Proving test | Execution result | Status |
|---|---|---|---|---|
| Exact behavior | path:lines | test name + fixture | command/output | pass/fail/unknown |
Keep unknown distinct from fail. A test that could not run is not a passing test.
1B. Preflight implementation plans for load-bearing assumptions
When the artifact under review is an implementation plan rather than completed code, identify every external behavior that several downstream tasks assume: server-owned tool execution, plugin loading, request-context propagation, restart/reload ownership, stable host identity, or update/rollback semantics.
Do not let later RED tests encode an unproven API contract. Insert the smallest real-runtime spike before dependent work, capture the exact request/event/context contract, and gate downstream tasks on it. If the plan routes opaque identifiers through model-visible prompt text, require a deterministic metadata/session channel or explicitly stop for the missing platform capability; model copying is not a trusted transport.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/amended-commit-rereview.md 9.0 KB
- references/cross-repository-contract-reconciliation.md 4.3 KB
- references/ios-simulator-triage.md 1.4 KB
- references/late-callback-generation-gating.md 1.3 KB
- references/load-bearing-assumption-spikes.md 2.9 KB
- references/milestone-vs-product-completeness.md 3.1 KB
- references/spec-compliance-review.md 3.1 KB
- references/start-stop-generation-race.md 2.2 KB
- references/typescript-validator-adversarial-review.md 1.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 512 lines · 35 tokens per session scan B b94ed575df2b
specification-compliance-review is a skill published in the GitHub repository AtlasOmnia/hermes-custom-pack (72 stars, last pushed yesterday), licensed MIT. It adds 35 tokens to every session and 13,324 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). It is 100% identical to specification-compliance-review, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
dogfood
This skill guides you through systematic exploratory QA testing of web applications using the browser toolset. You will navigate the application, interact with elements, capture evidence of issues, and produce a structured bug report.
pr-feedback
Works through review comments and failing CI on an open pull request, triaging each comment, fixing with tests, replying on every thread, and looping until CI is green. Use when asked to address review comments, fix CI, or handle PR feedback.
verify-acceptance
Runs the acceptance-verifier agent to map a diff against acceptance criteria and returns a PASS/FAIL/PARTIAL/UNTESTED matrix as JSON. Use for CI or headless runs, for example claude -p "/agents-virtuoso:verify-acceptance 123 origin/main".
readme-template
Standard README template for repos — professional structure with badges, overview, table of contents, features/modules, stack, installation, configuration, tests, security, structure, docs, roadmap, contribute, license, author + RepoActivity sections (Star History, repo stats) + profile GIF footer. Use when creating…
docker-single-port-multi-instance
Consolidate multiple Docker Compose app instances (production / test / demo) behind ONE host port using an nginx reverse proxy that routes by URL path prefix (e.g. /demo). Use when a user wants 'one port, several apps/banks' or a demo reachable simultaneously from the main landing page with its own database.
adhoc-verification
Produce fresh, focused, local verification evidence for a code change without relying on the full test suite. Use when a system reminder (or the user) demands ad-hoc verification after an edit, or when you want to prove one behavior in isolation. Covers the correct way to write a throwaway supertest/harness script…