Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/hermes-custom-pack --skill specification-compliance-reviewgit clone --depth 1 https://github.com/AtlasOmnia/hermes-custom-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review)<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/specification-compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/specification-compliance-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/specification-compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.13324 |
| Opus 5 | $0.00017 | $0.06662 |
| Sonnet 5 | $0.00007 | $0.02665 |
| Haiku 4.5 | $0.00003 | $0.01332 |
Grade B, and why
specification-compliance-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
A focused iOS verification should use an actually available simulator destination and then run the complete test target. Record the exact destination and distinguish “unverified due to unavailable destination” from a sou This is a copy
100% identical to specification-compliance-review — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 512 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Specification-Compliance Review
Overview
Use this skill when an implementation is described as partial, passing, or complete and the task is to determine whether it actually satisfies an explicit specification. This is not a generic code review and not a re-run of the test suite. The central question is: does every normative requirement have both a correct implementation path and a meaningful proof?
A green build proves syntax, compilation, and perhaps the tested examples. It does not prove race behavior, cancellation semantics, exact backpressure policy, integration parity, or compliance with explicit non-goals.
Workflow
1. Establish the review baseline
Read, in order:
- The task specification and surrounding plan/release gates.
- Repository guidance (
AGENTS.md, README, project instructions). - The changed files and their callers.
- The tests added or claimed as evidence.
- Git status/diff and recent relevant history.
Create a requirement matrix with one row per normative clause:
| Requirement | Production evidence | Proving test | Execution result | Status |
|---|---|---|---|---|
| Exact behavior | path:lines | test name + fixture | command/output | pass/fail/unknown |
Keep unknown distinct from fail. A test that could not run is not a passing test.
1B. Preflight implementation plans for load-bearing assumptions
When the artifact under review is an implementation plan rather than completed code, identify every external behavior that several downstream tasks assume: server-owned tool execution, plugin loading, request-context propagation, restart/reload ownership, stable host identity, or update/rollback semantics.
Do not let later RED tests encode an unproven API contract. Insert the smallest real-runtime spike before dependent work, capture the exact request/event/context contract, and gate downstream tasks on it. If the plan routes opaque identifiers through model-visible prompt text, require a deterministic metadata/session channel or explicitly stop for the missing platform capability; model copying is not a trusted transport.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/amended-commit-rereview.md 9.0 KB
- references/cross-repository-contract-reconciliation.md 4.3 KB
- references/ios-simulator-triage.md 1.4 KB
- references/late-callback-generation-gating.md 1.3 KB
- references/load-bearing-assumption-spikes.md 2.9 KB
- references/milestone-vs-product-completeness.md 3.1 KB
- references/spec-compliance-review.md 3.1 KB
- references/start-stop-generation-race.md 2.2 KB
- references/typescript-validator-adversarial-review.md 1.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 512 lines · 35 tokens per session scan B b94ed575df2b
specification-compliance-review is a skill published in the GitHub repository AtlasOmnia/hermes-custom-pack (56 stars, last pushed 27d ago), licensed MIT. It adds 35 tokens to every session and 13,324 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). It is 100% identical to specification-compliance-review, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
dogfood
This skill guides you through systematic exploratory QA testing of web applications using the browser toolset. You will navigate the application, interact with elements, capture evidence of issues, and produce a structured bug report.
simulate-agents
Run Mock User and Auditor agents against a feature in fresh contexts before human review. Use after verify-work, before request-review, when user wants pre-review simulation.
preview-spec
Makes a UI pull request autonomously verifiable. author generates a step-by-step UI verification spec for the PR's visual change and injects it into the PR description as a collapsed, machine-findable block (delegated to by create-pr on UI diffs; also runnable standalone). run extracts that block, resolves the PR's…
acceptance
Test a PR review end to end and prove it honoured every guarantee in INVARIANTS.md. Use when asked to test/validate a review of a pull request, to check a finished run, or to run the 3-provider x 2-runtime acceptance matrix. Drives pr-review verify and scripts/acceptance.mjs — never hand-checks the guarantees.
readme-template
Standard README template for repos — professional structure with badges, overview, table of contents, features/modules, stack, installation, configuration, tests, security, structure, docs, roadmap, contribute, license, author + RepoActivity sections (Star History, repo stats) + profile GIF footer. Use when creating…
docker-single-port-multi-instance
Consolidate multiple Docker Compose app instances (production / test / demo) behind ONE host port using an nginx reverse proxy that routes by URL path prefix (e.g. /demo). Use when a user wants 'one port, several apps/banks' or a demo reachable simultaneously from the main landing page with its own database.