Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add benjaminthomas/spec-driven-dev --skill spec-setupgit clone --depth 1 https://github.com/benjaminthomas/spec-driven-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-setup)<a href="https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-setup"><img src="https://agentmods.dev/badge/skills/benjaminthomas/spec-driven-dev/spec-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/benjaminthomas/spec-driven-dev/spec-setup"><img src="https://agentmods.dev/badge/skills/benjaminthomas/spec-driven-dev/spec-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00140 | $0.01741 |
| Opus 5.5 | $0.00056 | $0.00696 |
| Sonnet 5.5 | $0.00028 | $0.00348 |
| Haiku 4.5 | $0.00014 | $0.00174 |
Grade A, and why
spec-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
spec-setup
Learn this project's rules once, save them, and let every other spec-* skill reuse them. Team
rules live in a config file the team can review and change — never in the skills themselves.
Where the config lives
.spec-driven.yml, found by walking up from the current directory (stop at the home folder). The
first one found wins.
| Layout | Put the file in | Share it? |
|---|---|---|
single |
the repo root | Commit it — the whole team gets the same rules |
monorepo |
the repo root | Commit it |
multi-repo |
the shared parent folder of the repos (usually not itself a git repo) | Personal by default; offer to also commit a copy into the repo the team treats as "home" |
A multi-repo config only applies inside the repos it lists. If the current repo sits under that folder but isn't listed, treat it as having no config (ask whether to add it).
Step 1 — Detect before asking
Read, don't guess. Collect a draft of every field in references/config-template.yml:
- Layout.
- Inside a git repo with workspace markers (
pnpm-workspace.yaml,workspacesinpackage.json,turbo.json,nx.json,lerna.json,go.work,[workspace]inCargo.toml, severalapps/*/packages/*/services/*with their own manifests) →monorepo; list the packages. - Not inside a git repo, but sibling folders are git repos → candidate
multi-repo. Group them by remote owner (git remote get-url origin) and show the groups — the user picks which repos belong together. Never assume every folder in the parent belongs. Always also ask whether repos in other folders belong (e.g.~/clients/billing). Check each path is a git repo, and store paths inside the workspace as relative and paths outside it as absolute. - The repos of one workspace can live in unrelated places (
/Projects/frontend,~/Work/backend,/srv/database). Put the config in their shared parent folder, or in~/.spec-driven/<name>/when that parent would be the home folder or/. Then record it in~/.spec-driven/workspaces.json({"<config path>": ["<repo path>", …]}) so every repo can find it. - The user can override the detected layout. If they choose
multi-repofrom inside one repo, the workspace folder defaults to that repo's parent, with the current repo pre-selected. If they choosemonorepo, ask for the package folders. Never write amulti-repoconfig with no repos. - Otherwise →
single.
- Inside a git repo with workspace markers (
- Existing written rules.
CLAUDE.md,AGENTS.md,CONTRIBUTING.md, PR templates,.github/workflows. Anything stated there is a strong default — quote it back to the user. - Tracker. Ticket keys in recent branch names and commit subjects (
STP-123,#45,ENG-91), Jira/Linear links in PR templates or docs, whether GitHub Issues are enabled (gh repo view --json hasIssuesEnabled). - Git, per repo. Default branch (
git symbolic-ref refs/remotes/origin/HEADorgh repo view --json defaultBranchRef); integration branches (staging,develop,pre-prod); which branch recent PRs targeted (gh pr list --state merged --limit 20 --json baseRefName); the pattern of the last ~20 remote branch names; the commit style fromgit log -30 --format=%s. - Commands, per repo/package.
package.jsonscripts plus the lockfile's package manager,Makefile,pyproject.toml/tox.ini,Cargo.toml,go.mod,composer.json, CI workflow steps (CI is often the most truthful source). Dev URL from the dev script,.env.example, or framework defaults.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 118 lines · 140 tokens per session scan A 3afd59711116
spec-setup is a skill published in the GitHub repository benjaminthomas/spec-driven-dev (2 stars, last pushed 2d ago), licensed MIT. It adds 140 tokens to every session and 1,741 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-07.
spec-setup compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| spec-setupbenjaminthomas/spec-driven-dev | Skill | 2 | 2d ago | MIT | A | 140 | Claude Code |
| git-workflow-and-versioningaddyosmani/agent-skills | Skill | 114k | 6d ago | MIT | A | 131 | Claude Code |
| repo-activity-summaryCodeAlive-AI/ai-driven-development | Skill | 169 | today | MIT | A | 70 | Claude Code |
| git-workflowDevelopersGlobal/ai-agent-skills | Skill | 217 | 11d ago | MIT | A | 27 | Claude Code, Codex |
| to-codeGulajavaMinistudio/awesome-copilot-id | Skill | 93 | 11d ago | MIT | A | 51 | Claude Code, Codex |
| shipping-and-launchvinvcn/addyosmani-agent-skills-zh | Skill | 47 | 19d ago | MIT | A | 49 | Claude Code |
| polya-fast-trackGulajavaMinistudio/awesome-copilot-id | Skill | 93 | 11d ago | MIT | B | 87 | Claude Code, Codex |