Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add atman-33/workhub --skill update-specgit clone --depth 1 https://github.com/atman-33/workhubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atman-33/workhub/update-spec)<a href="https://agentmods.dev/skills/atman-33/workhub/update-spec"><img src="https://agentmods.dev/badge/skills/atman-33/workhub/update-spec.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00543 |
| Opus 5 | $0.00028 | $0.00271 |
| Sonnet 5 | $0.00011 | $0.00109 |
| Haiku 4.5 | $0.00006 | $0.00054 |
Grade A, and why
update-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Update the living spec
docs/spec/spec.md answers "what is implemented today, by feature area" —
kept truthful by folding in what actually merged, not what was planned.
Steps
- Check there is anything to do: compare each repo's
repo-state.json.lastSyncAt/ newcommits.jsonlentries against the spec's last-updated marker (an HTML comment at the top ofspec.md, e.g.<!-- last-updated: 2026-07-20 / app@abc1234 api@def5678 -->). No new merges since the marker → stop and report "no change" — this is what keeps the daily routine cheap. - Gather what merged: new commits per repo grouped by PBI id
(
pbi-activity.json+commits.jsonl), and for each involved PBI its## Acceptance Criteria(satisfied AC = implemented behavior). Inspect actual diffs in the script-owned mirror (git -C <mirrorPath> show <sha>) only where the commit subject + AC leave the behavior unclear. - Fold into
spec.md(team content language):- Organized by feature area (grow headings as the product grows), not by sprint or PBI — a newcomer reads it as "how the product works".
- Update the areas the merged PBIs touched; state current behavior, and
reference source PBIs inline (
(P-0012)) for traceability. - Move superseded statements out — the spec describes the present, the git history keeps the past.
- Refresh the last-updated marker with today's date and each repo's synced tip sha.
- Append an activity-log line
(
- <date> [...] update-spec: folded P-0012, P-0015 into spec.md).
Rules
- Never describe unmerged work as implemented. Planned work lives in the backlog, not the spec.
- When
spec.mdoutgrows one file, split intodocs/spec/<area>.mdwithspec.mdas the index — propose this to the user first.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 43 lines · 56 tokens per session scan A c3769ed33618
update-spec is a skill published in the GitHub repository atman-33/workhub (2 stars, last pushed 2d ago), licensed MIT. It adds 56 tokens to every session and 543 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
tasks
A task-breakdown tool that turns a plan, specification, feature brief, bug report, technical-debt item, or chore into small TASK-NNN work items. Technical debt means postponed cleanup or design work in a codebase.
prd
A Product Requirements Document (PRD) writer for large software initiatives. A PRD records the problem, goals, requirements, assumptions, and evidence before implementation begins.
roadmap
An implementation plan made from a technical specification, organized into phases, milestones, and dependencies.
pr
A command for managing pull requests on GitHub or Bitbucket Server. A pull request is a request for other developers to review and merge changes into a project branch.
shipyard-writing-plans
Use when you have a spec, requirements, or design for a multi-step task — before touching code. Also triggers on "plan this", "break this down", "create tasks", "decompose this feature", or when a task clearly needs more than 2-3 steps to implement. If you're about to start building without a plan, or writing vague…
sync
Rebuild PROJECTSTATE derived fields from artifact files.