Borrowing it
Nothing to install: this file belongs to dogganidhal/noddde. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dogganidhal/noddde/main/.claude/skills/validate-spec/SKILL.mdgit clone --depth 1 https://github.com/dogganidhal/nodddeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dogganidhal/noddde/validate-spec)<a href="https://agentmods.dev/skills/dogganidhal/noddde/validate-spec"><img src="https://agentmods.dev/badge/skills/dogganidhal/noddde/validate-spec/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dogganidhal/noddde/validate-spec"><img src="https://agentmods.dev/badge/skills/dogganidhal/noddde/validate-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 5 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- medium MCP Rug Pull · line 102 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 106 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01759 |
| Opus 5.5 | $0.00014 | $0.00704 |
| Sonnet 5.5 | $0.00007 | $0.00352 |
| Haiku 4.5 | $0.00004 | $0.00176 |
Grade A, and why
validate-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Step 5: Validate Spec Against Implementation
Final cross-check: verify the implementation fully satisfies the spec, beyond just passing tests.
Pipeline step 5 of 6. Called by the /spec orchestrator after step 4 (tests GREEN).
Why this step exists: Tests can pass while the implementation still drifts from the spec — missing exports, unenforced invariants, unhandled edge cases, leftover stubs. This step catches that.
Step 1: Find Spec and Source
Accept either a spec path or source file path:
- Spec → source: read
source_filefrom frontmatter - Source → spec: replace
packages/core/src/withspecs/core/,.tswith.spec.md
Read both files completely. Also read the test file.
Step 2: Export Coverage
Compare the spec's exports frontmatter against the source file's actual exports.
Export Coverage:
✅ AggregateTypes — exported in source
✅ defineAggregate — exported in source
❌ InferAggregateID — listed in spec but NOT exported in source
⚠️ HelperUtil — exported in source but NOT listed in spec
Flags:
- ❌ = spec promises this export but it's missing → implementation gap
- ⚠️ = source exports something the spec doesn't mention → spec may be incomplete, or export is internal
Step 3: Behavioral Requirement Audit
For each numbered behavioral requirement in ## Behavioral Requirements:
- Read the requirement
- Search the source file for the implementation
- Check if a corresponding test exists in the test file
- Grade: ✅ (implemented + tested) | 🔧 (implemented, not tested) | ❌ (not implemented)
Behavioral Requirements:
1. ✅ "DecideHandlerMap requires one handler per command name" — enforced via mapped type, tested
2. ✅ "defineAggregate is a pass-through identity function" — implemented, tested
3. ❌ "Command handler returns single event normalized to array" — stub in source
Step 4: Invariant Check
For each invariant in ## Invariants:
- Check if it's enforced by the type system (compile-time) or runtime check
- Check if there's a test that would catch a violation
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 223 lines · 36 tokens per session scan A 151c05ee9cb9
validate-spec is a skill published in the GitHub repository dogganidhal/noddde (52 stars, last pushed 1mo ago), licensed MIT. It adds 36 tokens to every session and 1,759 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-review-architecture
Architecture-focused code review covering hexagonal boundary violations, DDD anti-patterns, CQRS misuse, and microservices coupling issues. Applied in addition to the language-specific review skill when architecture markers are detected. Invoked when reviewing hexagonal architectures, DDD patterns, or microservices…
cratis-chronicle-client-typescript
Use when connecting a standalone Node.js process to Chronicle or diagnosing its decorators, discovery or client lifecycle. Not for React generated proxies or another language's client.
cratis-arc-command-typescript
Use when bootstrapping an Arc Node.js server or defining its TypeScript commands. Not for frontend proxy consumption, validation-only changes or server queries; use the corresponding Arc sibling.
cratis-arc-query-typescript
Use when declaring Arc Node.js read-model queries or observable endpoints. Not for React proxy consumption, server commands or Chronicle event materialization.
cratis-arc-validation-typescript
Use when adding rejection rules, state checks or validation assertions to an Arc Node.js server. Not for defining commands or queries, C# and JVM validators, or append-time uniqueness.
cratis-engineering-review-rounds
Use when choosing a review round, handling review feedback or requesting a delta since the last reviewed SHA. Not for review criteria (cratis-code-review), release-candidate grouping (cratis-engineering-release-trains) or waiting on CI checks (cratis-engineering-ci-gates).