Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ccoalm/ccl-skills --skill requirement-baselinegit clone --depth 1 https://github.com/ccoalm/ccl-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccoalm/ccl-skills/requirement-baseline)<a href="https://agentmods.dev/skills/ccoalm/ccl-skills/requirement-baseline"><img src="https://agentmods.dev/badge/skills/ccoalm/ccl-skills/requirement-baseline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccoalm/ccl-skills/requirement-baseline"><img src="https://agentmods.dev/badge/skills/ccoalm/ccl-skills/requirement-baseline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00192 | $0.02638 |
| Opus 5 | $0.00096 | $0.01319 |
| Sonnet 5 | $0.00038 | $0.00528 |
| Haiku 4.5 | $0.00019 | $0.00264 |
Grade A, and why
requirement-baseline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Requirement Baseline
把「现在到底怎么运作」变成一份有来源、有 freshness、缺口显式的 as-is 清单。改需求之前先弄清现状、已有能力是什么、缺口在哪里时进入本技能。
选型与评估依赖现状事实时同样进本技能：判断采用/扩展/替换/下线哪个组件、某能力是否已存在、某系统当下如何运作——结论落在别处（product-rd-workflow 的 gate），但支撑结论的事实归本技能取证，取证纪律见硬约束 1。
硬约束（先读，全程适用）
- 不下产品决策。 只描述现状，不判断「应该怎么改」。代码、数据、架构等描述性证据不裁决 should-be。最高频的越界形态是拿可用性证据当选型结论：仓库活跃度、最近提交时间、「跑得起来」「有 API」「另一个候选已停更」只说明某物存在且能用，不说明它该被采用——这类事实照记，但不得推出「所以选它」。该记而常被略过的是候选的自述定位（README 首句、manifest 描述）——它出自制品自身，属现状事实；查不到就记「自述定位未查到」并列出已查来源，不得代拟。层级归属分现状与目标两栏，不可混填：现状层级按部署配置、依赖图等有来源的现状证据照记（这是本技能的本职，不因目标架构缺失而丢弃）；目标层级仅当有来源的目标架构明确写到该候选时才记，架构未确认与架构未涵盖该候选要分别记明，作为证据缺口交回决策 owner，不得靠推断补齐。
- 三态判定，权威 baseline 不得记 N/A。 用共享契约的 current-state 三态；新鲜权威 baseline 记
satisfied-by-authoritative-baseline。 not-applicable的全部前置条件：仅当是有边界的存在性检查、且能证明净新增、且不触及既有流程、权限、数据、API、规则、迁移、兼容或旧版本行为时才可判。任一条不成立即不得判。- 未查到 ≠ 不存在。 正常取证后仍未查到的能力、接口、数据、权限、审核流或模型能力，不得写成已确定字段；对应 requirement 行不得设为
closed。 - 关闭表只补自己那部分。 唯一 canonical 是
requirement-doc-writer/references/requirement-closure-contract.md。本技能以evidence-derived只填 as-is 描述性事实，或有效已批准规范性来源授权范围内的字段；记录 decision_authority、source、推导、冲突处置和重开条件，只提出行状态候选，不得把整行设为closed。
安全 4 问（命中即阻断）
现状涉及身份、计费、配额、租户/用户隔离、权限、删除、覆盖时，盘点必须逐项记录安全 4 问的现状答案（无命中则显式记"无安全敏感输入"）。命中上述任一项时，必须先读取 requirement-doc-writer/references/security-four-questions.md（问题本体与现状（as-is）应用细则 canonical）再作答，并在产物中写明所依据的 canonical 文件名 security-four-questions.md（实测：要求一段固定字样的旧写法命中率仅 20.5%，而逐项作答与写明来源文件分别可达 82% / 59%——本仓无法机械校验运行时产物，故只要求可核的实质，不要求不可核的字面戳）；凭记忆或转述作答、未写明来源、或命中后仍记"无命中"，均为违规。读取不可得时（本会话无文件读取工具 / 文件缺失 / 读取失败）走这条路径，不得声称已读：改写 依据: 不可得(<原因>)；按常驻反射尽力作答、本节标 interim 并写出解除方式，缺口连同风险标签交 feature-risk-router，由风险 owner 决定是否接受推迟——接受的是推迟、不是关闭：本节转正式关闭仍须真实读取 canonical 后逐项重答；agent 与需求提出方均不得自行判为已关闭。always-on 常驻反射见 agent-context/session-start.md「设计期安全 4 问」；本节只定义产物落点与交接。
命中后把风险标签和 gate 选择交给 feature-risk-router；需要研发改动时交给 product-rd-workflow。
产出
| 模块 | 内容 |
|---|---|
| 事实来源 | 文档、界面、代码、配置、数据样例、运营规则、访谈记录；标注新旧和可信度 |
| 用户路径 | 用户入口、步骤、状态变化、异常/回退路径 |
| 系统路径 | 页面/API/服务/数据/规则之间的链路；不确定处标注 |
| 已有能力 | 已可用能力、约束、默认行为、例外规则；盘点对象是候选组件/服务时另记其自述定位（查不到就填「自述定位未查到」并列出已查来源，不得留空或代拟），层级归属分现状栏与目标栏：现状栏只填有来源的现状证据（部署配置、依赖图等），目标栏仅在目标架构明确写到该候选时填，否则按「架构未确认」与「架构未涵盖该候选」分别记明，两栏都不得填推断值 |
| 缺口 | 与目标或问题陈述不匹配的空白、冲突、重复能力 |
| 风险/不确定 | 事实不足、过期来源、权限/数据/删除/覆盖风险 |
| 需求点关闭表 | 按共享契约补事实依据、freshness、冲突和证据缺口 |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +18 tokens per session 3c54a33449fb
- 10d ago First seen · 88 lines · 174 tokens per session scan A 0b00a3306762
requirement-baseline is a skill published in the GitHub repository ccoalm/ccl-skills (6 stars, last pushed today), licensed Apache-2.0. It adds 192 tokens to every session and 2,638 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
feature-dev
Guide a feature implementation through a structured seven-phase workflow with deep codebase understanding, clarifying questions, parallel architecture design, and quality review. Use this skill when the user asks to build a new feature, add functionality, or wants a methodical approach to implementation rather than…
memstack-business-client-onboarding
Use this skill when the user says 'client onboarding', 'new client', 'onboard client', 'kickoff meeting', 'intake form', 'welcome email', or needs welcome sequences, questionnaires, and setup checklists for new clients. Do NOT use for contracts or invoicing.
memstack-product-roadmap-builder
Use this skill when the user says 'roadmap', 'product roadmap', 'quarterly plan', 'now/next/later', 'OKRs', or needs strategic planning with themes, milestones, resource allocation, and stakeholder-ready views. Do NOT use for MVP scoping or sprint-level planning.
memstack-product-mvp-scoper
Use this skill when the user says 'MVP', 'minimum viable product', 'scope the MVP', 'what should I build first', 'strip to core', or needs to define the smallest build that validates a product hypothesis. Do NOT use for full PRDs or roadmap planning.
memstack-product-user-story-generator
Use this skill when the user says 'user stories', 'write stories', 'backlog', 'sprint planning', 'acceptance criteria', or needs prioritized stories with Given/When/Then criteria and story point estimates. Do NOT use for full PRDs or detailed feature specs.
memstack-marketing-marketplace-submit
Use when the user says 'submit to marketplace', 'publish my skill', 'share this skill', 'list on marketplace', 'submit plugin', 'publish to community', or needs to submit a skill or plugin to a community marketplace via PR. Do NOT use for building skills or writing plugin code.