What is prospec-review?

An independent code-review workflow that checks an entire change and can feed confirmed serious problems into a fix-and-verify loop.

Use it to inspect code changes, check them against specifications and dependency direction, automatically fix confirmed critical issues, and report major issues for later verification.

It provides a fresh review of the change and prevents critical findings from being silently ignored before verification.

prospec-review — Skill for Claude Code and Codex by benwu95

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add benwu95/prospec --skill prospec-review

Clone the repo

git clone --depth 1 https://github.com/benwu95/prospec

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/benwu95/prospec/prospec-review.svg)](https://agentmods.dev/skills/benwu95/prospec/prospec-review)

Your own site

<a href="https://agentmods.dev/skills/benwu95/prospec/prospec-review"><img src="https://agentmods.dev/badge/skills/benwu95/prospec/prospec-review.svg" alt="Measured on agentmods" height="20"></a>

Per session 94 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,835 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00094	$0.04835
Opus 5	$0.00047	$0.02417
Sonnet 5	$0.00019	$0.00967
Haiku 4.5	$0.00009	$0.00483

Measured yesterday against content hash 9ade5a786de2, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

prospec-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/prospec-review/SKILL.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Prospec Review Skill

Activation

When triggered, briefly describe:

That an independent reviewer (fresh context) will audit the entire change diff between implement and verify
That only verifier-confirmed criticals are auto-fixed; majors are proposed and passed to verify as WARN
That the loop converges to zero unresolved critical or escalates to you at a hard cap — review never silently passes

CLI Prerequisite (required)

The prospec CLI is a required file for this skill — its deterministic steps call prospec commands. Probe BEFORE any other step; there is no manual fallback.

Run prospec --version (Bash).
Command not found / not executable → STOP. Ask the user to install the prospec standalone executable — the one-click installer script from the project README (macOS/Linux install.sh, Windows install.ps1) or a release binary from GitHub Releases; prospec is NOT published to npm. Then re-run this skill.
Version older than 2.1.0 → STOP. Report the installed vs required version and ask the user to upgrade, then re-run this skill.

Hand-executing a CLI-owned mutation is NEVER the fallback — that re-introduces the nondeterministic serialization this contract exists to remove.

Evidence uses snapshot-v2 / repository-inputs-v2: repository input content, independent of staging and equivalent commit history. Complete Knowledge/count/generated-asset sync before the final review, test record and verification. A legacy record needs one real revalidation; an equivalent commit alone needs no re-record.

Startup Loading

[STABLE] Read prospec/CONSTITUTION.md — principles and dependency/layering rule
[STABLE] MANDATORY — Read references/review-format.md for the severity contract, review.md format, and reviewer lenses
[DYNAMIC] Read .prospec/changes/[name]/tasks.md, plan.md, delta-spec.md, proposal.md — the contract this change must honour
[DYNAMIC] Read prospec/ai-knowledge/_conventions.md + each affected module README.md — patterns and ripple effects
[DYNAMIC] Compute the change diff relative to the branch base (git diff), reviewing source + tests; exclude generated artifacts (dist/, lockfiles, deployed skills)

Read the full file on GitHub · 163 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed · +2 lines 9ade5a786de2
3d ago Changed · +5 lines c94efa02dab5
7d ago First seen · 156 lines · 94 tokens per session scan A 27db2a2f2017

Subscribe to this mod's changes

prospec-review is a skill published in the GitHub repository benwu95/prospec (5 stars, last pushed 2d ago), licensed MIT. It adds 94 tokens to every session and 4,835 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review agentic-coding ai-coding-assistant ai-knowledge progressive-disclosure sdd spec-driven-development

ospec-goal

Create or advance a full OSpec goal using the current document, task graph, worker, review, and evidence workflow.

clawplays/ospec · 29 tokens

ospec

Document-driven OSpec workflow for initialization, change/goal routing, validation, archiving, and durable project knowledge.

clawplays/ospec · 26 tokens

ospec-change

Create or advance a lightweight OSpec change using the classic fast workflow.

clawplays/ospec · 18 tokens

review-spd

Findings-first code review workflow for AI coding agents. Use when the user asks to review uncommitted changes, commits in a date range, or a branch compared to the main branch / PR-style diff. Focuses on bugs, regressions, correctness risks, missing tests, security/data-safety issues, and other behavior-changing…

zhu1090093659/spec_driven_develop · 72 tokens

code-review

Review implementation code against the plan for drift, gaps, and blind spots. Triggers: /code-review, review code, check implementation, compare to plan, code vs plan.

danweinerdev/claude-sdd-planner · 38 tokens

auto-review

Drain the orchestrator review-queue — for each task awaiting review, run the code-reviewer, optionally a Codex/Gemini second opinion on CRITICAL.md paths, compose a verdict, and advance it to reviewed or escalate an architectural finding to you. Interactive session only.

firatcand/forge · 59 tokens