Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add BuildrAI/Buildr --skill openspec-contract-guardgit clone --depth 1 https://github.com/BuildrAI/BuildrWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/buildrai/buildr/openspec-contract-guard)<a href="https://agentmods.dev/skills/buildrai/buildr/openspec-contract-guard"><img src="https://agentmods.dev/badge/skills/buildrai/buildr/openspec-contract-guard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/buildrai/buildr/openspec-contract-guard"><img src="https://agentmods.dev/badge/skills/buildrai/buildr/openspec-contract-guard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00609 |
| Opus 5.5 | $0.00017 | $0.00244 |
| Sonnet 5.5 | $0.00009 | $0.00122 |
| Haiku 4.5 | $0.00004 | $0.00061 |
Grade A, and why
openspec-contract-guard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
OpenSpec 接入保护
标准规范解析、重建、正常写入及归档由已验证的 OpenSpec 1.13.0 安装负责。Buildr 只组合真实工作根与版本检查、相关变更冲突和必要中断恢复；不修改上游技能（Skill）正文。
只读检查
在当前工作空间（Workspace）或已核对的工作树（Worktree）中运行：
buildr openspec convergence preflight <change> --project <project> --target <actual-work-root> --json
检查当前变更及相关规范条目是否被其他进行中变更修改。可证明无关的损坏内容只形成提醒；无法判断影响范围时报告最小缺口。ready 只对应本次观察，不是后续写入授权，不要求复制全项目执行隔离验证。
按请求范围执行
- 实现：根据已授权目标修改代码与当前变更材料，按需要调用相关检查。
- 只同步：执行上游 openspec-sync-specs，更新正式规范并保留变更。不调用 converge。
- 归档：确认当前变更任务完成且归档属于用户目标后，调用
buildr openspec converge <change> --project <project> --target <actual-work-root> --json。该命令使用上游完整规范写入和归档流程；只有恢复现场已经证明规范全部写入时才跳过重复规范写入。
不因阶段转换重复运行完整验证。上游命令保护与智能体直接编辑的保证不同，报告必须对应真实路径。
失败与恢复
buildr openspec convergence inspect <change> --project <project> --target <actual-work-root> --json 只读检查仍存在的恢复记录与真实文件。进程中断后复用同一操作与已观察输入；全部规范已经写入时只继续归档。混合状态、输入变化或并发修改不能安全证明时返回 recovery-unprovable，保留文件及记录，不自动回滚他人修改。
旧格式恢复材料保留并报告明确诊断；不把旧记录当作新写入授权。归档成立但记录释放失败时只处理释放，不重新同步。既有交付事实不因恢复或清理失败被撤销。
报告实际动作、状态、效果与必要下一步，不把内部过程记录当作长期产品事实。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -27 lines · -28 tokens per session c47c6bfea5b6
- 1mo ago Changed fea471330142
- 1mo ago Changed 34c3561be6ab
- 1mo ago First seen · 66 lines · 71 tokens per session scan A e3ea1b3ca847
openspec-contract-guard is a skill published in the GitHub repository BuildrAI/Buildr (28 stars, last pushed yesterday), licensed MIT. It adds 43 tokens to every session and 609 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
create-pr
Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for Prisma 8. Use when the user wants to create a pull request, open a PR, or submit changes for review.
git-commit
Generate well-formatted git commit messages following conventional commit standards.
repo-sync
Manage automatic Git syncing on macOS with repo-sync. Use only when the user explicitly invokes /repo-sync.
mcore-split-pr
Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.
contributing
How to contribute to evlog, covering commit and PR conventions, changesets, the Definition of Done, testing rules, and the authored skills that walk through building a new adapter, enricher, framework integration, or map rule. Load this for any question about contributing, opening a PR, or adding something to the…
engineer-bot-ops
A workflow for carrying an engineering task from scope through implementation and reviewable delivery. It works with a repository's branch, existing changes, rules, checks, and permissions while separating completed, unverified, and next-step work.