spec-review

spec-review is a skill for Claude Code from benjaminthomas/spec-driven-dev. It costs 163 tokens per session (2,003 once invoked), scanned A, original, MIT.

A final review procedure for a completed software change. It compares the branch difference with the written specification, project rules, and code, then records verified findings in a review file.

In plain words
What is it for?
Use it to review changes across one or more repositories for correctness, security, performance, documentation, and test coverage before release.
Why use it?
It helps catch missing requirements, out-of-scope edits, security or error-handling problems, and inadequate tests before a change is merged. It checks findings against the actual code rather than reporting guesses.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the ticket-to-pr plugin — 9 skills shipped together

Good fit Use it to review changes across one or more repositories for correctness, security, performance, documentation, and test coverage before release.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/benjaminthomas/spec-driven-dev/spec-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add benjaminthomas/spec-driven-dev --skill spec-review
Clone the repo
git clone --depth 1 https://github.com/benjaminthomas/spec-driven-dev

Made for: Claude Code.

Or install ticket-to-pr, the plugin that ships this one along with the rest of its 9 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for spec-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/benjaminthomas/spec-driven-dev/spec-review/github.svg)](https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-review)
Your own site
<a href="https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-review"><img src="https://agentmods.dev/badge/skills/benjaminthomas/spec-driven-dev/spec-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for spec-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-review"><img src="https://agentmods.dev/badge/skills/benjaminthomas/spec-driven-dev/spec-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 163 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,003 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00163 $0.02003
Opus 5.5 $0.00065 $0.00801
Sonnet 5.5 $0.00033 $0.00401
Haiku 4.5 $0.00016 $0.00200

Measured today against content hash 74c0ca189fd6, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

spec-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/skills/spec-review/SKILL.md · 138 lines

How it starts

The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review the change

spec-implement reviews each batch as it's built. This skill reviews the finished whole, the way a careful human reviewer would before merge: does it do what was asked, does it follow how this project works, and is the code sound? Every finding is checked against the code before it's reported. A short list of real problems beats a long list of guesses.

investigate → create → approve → implement → verify → review → checkpoint → ship

Project config (read first)

Load .spec-driven.yml: walk up from the current directory to the home folder, and the first one found wins (a multi-repo config only applies inside the repos it lists). If none is found, check ~/.spec-driven/workspaces.json, which maps each multi-repo config to its repo paths. Use the config whose repos contain the current directory. Its values beat anything you would detect or assume. This skill uses git (base branch, PR target), commands (lint/typecheck/test), models/effort, layout/repos, and specs_dir.

Multi-repo: review each listed repo that has changes on this branch, and write one review.md covering all of them. No config? Work from the repo itself and say what you assumed.

Step 1: Work out what to review

The user gave Diff to review Spec
nothing, on a spec's branch git diff <merge-base with pr_target>...HEAD, plus uncommitted changes {specs_dir}/{feature}/ matched by branch or ticket
a PR number or URL gh pr diff <n> and gh pr view <n> the PR's linked spec, if any
a branch, commit range, or paths that diff none, unless one matches

No spec? Review against the PR or commit description and the code alone, and say so in the report.

Step 2: Load only what the review needs

Keep it cheap, because the diff is the expensive part:

  1. The README's Resume here block, requirements.md (requirements R1… and Coverage), and the investigation's Relevant Context. Without a spec, read {specs_dir}/CONTEXT.md and only the context/<area>.md files the diff touches. Never the archive.
  2. git diff --stat first, then the diff itself. Open a full file only around a suspected finding, to confirm it.
  3. Optional graph. If context.graph isn't off and graphify is available, use graphify query "callers of <changed function>" --budget 1000 to find callers the diff didn't update. Treat INFERRED edges as hints to check.

Read the full file on GitHub · 138 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 138 lines · 163 tokens per session scan A 74c0ca189fd6

Subscribe to this mod's changes

spec-review is a skill published in the GitHub repository benjaminthomas/spec-driven-dev (2 stars, last pushed today), licensed MIT. It adds 163 tokens to every session and 2,003 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-11.

Related

spec-review compared with skills from other repositories

spec-review next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
spec-reviewbenjaminthomas/spec-driven-devSkill2todayMITA163Claude Code
application-security-pentestinghamzabellouch/agent-skillsSkill826d agoMITA43Claude Code, Codex
triagehamzabellouch/agent-skillsSkill826d agoMITA33Claude Code, Codex
doubt-driven-developmentaddyosmani/agent-skillsSkill115k10d agoMITA96Claude Code
agentic-readinessCodeAlive-AI/ai-driven-developmentSkill1692d agoMITA76Claude Code, Codex
ponytail-lazy-senior-devGulajavaMinistudio/awesome-copilot-idSkill9414d agoMITA146Claude Code
code-that-fits-in-your-headCodeAlive-AI/ai-driven-developmentSkill1692d agoMITA169Claude Code