Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add chenweil/skillcaddy --skill spec-role-contractgit clone --depth 1 https://github.com/chenweil/skillcaddyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chenweil/skillcaddy/spec-role-contract)<a href="https://agentmods.dev/skills/chenweil/skillcaddy/spec-role-contract"><img src="https://agentmods.dev/badge/skills/chenweil/skillcaddy/spec-role-contract/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chenweil/skillcaddy/spec-role-contract"><img src="https://agentmods.dev/badge/skills/chenweil/skillcaddy/spec-role-contract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.01824 |
| Opus 5.5 | $0.00042 | $0.00730 |
| Sonnet 5.5 | $0.00021 | $0.00365 |
| Haiku 4.5 | $0.00011 | $0.00182 |
Grade A, and why
spec-role-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
文档生命周期角色契约
原件库的技能按任务分工（research / review / implement），不按文档生命周期位置分工。所以"作者不能自己批准方向""实施者不能改方向""验证者要对照文档而不是对话"这些约束,没有任何一个技能在管。
这个技能管。它不分配模型,只声明位置和边界。
三个位置
| 位置 | 负责 | 明确不能做 |
|---|---|---|
| author 作者 | 写 TECH.md、补研究、接外部草稿 |
不自我批准方向。草稿的作者不能同时是批准方向的人 |
| implementer 实施者 | 按已批准文档写实现 | 不改方向。发现方向有问题必须回到 spec-direction-gate,不能自己改 |
| verifier 验证者 | 对照文档验收 | 不对照对话验收。判定依据是 TECH.md 本身,不是"当初说过什么" |
这三个位置可以由同一个模型担任,但不能由同一次会话兼任 author 和 verifier。这是唯一不可让步的一条。
硬性约束
- 角色是显式参数,不是隐含的会话假设。 每一格都要显式声明当前是谁在做。默认角色是 author。
- 不绑定模型品牌。 0036 第 110 行已记录"固定模型品牌也没有成为必要条件"。角色边界与用哪个模型无关,反过来也一样。
- 验证者必须新会话。 沿用 0035 第 3.2 节已定做法。这条是硬约束,理由见下。
- 边界靠落盘记录核验,不是靠自觉。 角色写进
specs/<id>/ROLE.md,验收时读文件。
为什么验证者必须换会话
author 在写文档时看过所有的权衡、放弃过的方案、对问题的理解。带着这些上下文去验收自己的实现,等于用出题人的答案去判卷。0035 缝二的判断在这里成立:skill 只能告诉你"这一格跑什么",保证不了"不是同一个会话"。
需要说清楚的是,库里现有的跨会话机制不是会话隔离。planning-with-files 靠的是磁盘上的持久 markdown 文件——它能让你在第二次会话里恢复上下文,但它恢复的恰恰是 author 的上下文。恢复得越顺,污染越彻底。所以本技能不依赖它做隔离,只依赖它做持久化;隔离由"换会话"这个动作本身承担。
code-review 的并行 sub-agent 是另一个可借的机制:它把 Standards 和 Spec 两条轴分开跑以免互相污染。author 与 verifier 需要的正是这类隔离,只是要跨会话而不是跨 sub-agent。
流程
第 1 步：声明角色
开工前写明本次是谁在做。落盘到 specs/<id>/ROLE.md：
# Roles
| 位置 | 谁 | 会话 | 状态 |
| --- | --- | --- | --- |
| author | <名字 / 模型> | <会话标识> | 进行中 |
| implementer | <名字 / 模型> | <会话标识> | 未开始 |
| verifier | <名字 / 模型> | <会话标识> | 未开始 |
## Boundaries
- author 不得批准方向。方向批准由 `spec-direction-gate` 在独立的确认中记录。
- implementer 不得改方向。发现方向错误时回到 `spec-direction-gate`。
- verifier 不得与 author 同会话。验收依据是 `TECH.md`,不是对话。
第 2 步：按角色约束自己
每次要做的动作先过一遍上表的"明确不能做"。越界了不执行,改走正确路径。
最常被踩的一条:实施中发现了文档里写错的东西。改文档不等于改方向——补充实现细节、补行级引用、更新验证方式都属于实施者的合法范围;换了方案、改了目标、改了非目标,才是改方向,必须回关卡。
第 3 步：交接时更新状态
从一个位置换到下一个位置时更新 ROLE.md 的状态,并记录会话标识换了。
verifier 那一行的会话标识必须与 author 不同。这一栏是 ## Boundaries 唯一可被机器检查的证据,空着或相同都算违规。
第 4 步：验收时核验
verifier 开跑前先读 ROLE.md 和 TECH.md:
TECH.md的## Approval段存在且方向为"通过"——否则没有可验收的批准状态,返回未批准verifier与author不同会话——否则验收结论作废,要求换会话重来- 判定依据只能是
TECH.md。对话里"当时说过以 X 为准"不构成依据
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago First seen · 114 lines · 106 tokens per session scan A 0a1922fdbd6f
spec-role-contract is a skill published in the GitHub repository chenweil/skillcaddy (29 stars, last pushed 5d ago), licensed MIT. It adds 106 tokens to every session and 1,824 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other skills, from other repositories
exploratory-data-analysis
Performs bounded, local exploratory analysis of explicitly supported scientific files. Supports redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
design-review
Review a web app or page for visual design quality — layout, typography, spacing, colour, hierarchy, consistency, interaction patterns, and responsive behaviour. Not a UX audit (that checks usability) — this checks whether it looks professional and polished. Produces a design findings report with screenshots.…
react-patterns
React 19 performance patterns and composition architecture for Vite + Cloudflare projects. 50+ rules ranked by impact — eliminating waterfalls, bundle optimisation, re-render prevention, composition over boolean props, server/client boundaries, and React 19 APIs. Use when writing, reviewing, or refactoring React…
render-3d-product-showcase
Assemble a premium 3D product-showcase ad from a config — four beat clips (an orbiting hero rotation, a macro push-in, a physics reveal, a typographic close) normalized to the chosen backdrop colour, hard-concatenated in order, closed on a deterministic Playwright brand end card, and mixed under one instrumental bed…
render-airdrop-carousel
Assemble a viral iOS "AirDrop" notification-carousel video ad (≈6–8s, 9:16) from a brand line plus 6–16 real product photos — a native AirDrop share-sheet card ("Brand would like to share a · Decline / Accept") springs up and its preview window CYCLES through the products, landing on a range/lineup payoff with an…