OpenSpec: Skill for Codex

.agents/skills/release-openspec/SKILL.md

release-openspec is a skill for Codex from Fission-AI/OpenSpec. It costs 88 tokens per session (2,870 once invoked), scanned A, original, MIT.

A step-by-step release workflow for OpenSpec, a software project that publishes versioned releases through GitHub and Changesets.

In plain words
What is it for?
Use it to audit release readiness, create or resume a version-packages pull request, publish beta or stable releases, verify publishing, and improve GitHub release notes.
Why use it?
It helps check whether merged work has release notes, prepare package versions, publish releases, and verify the result without losing track of the current release state.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: installed under .agents/ (shared by several agents).

This is Fission-AI/OpenSpec's own configuration. It tells Codex how to work on OpenSpec itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything OpenSpec configures →

About the project

OpenSpec is a specification-driven development framework that records software requirements and implementation plans as readable Markdown artifacts. It helps developers and AI coding assistants agree on what should be built before code is written, including work spanning multiple repositories. The catalogue add-ons provide workflow skills and instructions for using OpenSpec.

Fission-AI/OpenSpec · 74,064 stars · on GitHub · openspec.dev

Reuse

Borrowing it

Nothing to install: this file belongs to Fission-AI/OpenSpec. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Fission-AI/OpenSpec/main/.agents/skills/release-openspec/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Fission-AI/OpenSpec

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for release-openspec

README.md
[![agentmods](https://agentmods.dev/badge/skills/fission-ai/openspec/release-openspec/github.svg)](https://agentmods.dev/skills/fission-ai/openspec/release-openspec)
Your own site
<a href="https://agentmods.dev/skills/fission-ai/openspec/release-openspec"><img src="https://agentmods.dev/badge/skills/fission-ai/openspec/release-openspec/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for release-openspec

Your own site · 80×15
<a href="https://agentmods.dev/skills/fission-ai/openspec/release-openspec"><img src="https://agentmods.dev/badge/skills/fission-ai/openspec/release-openspec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 88 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,870 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket pass 24 Oct 2026
  • Snyk warn 24 Oct 2026
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00088 $0.02870
Opus 5.5 $0.00035 $0.01148
Sonnet 5.5 $0.00018 $0.00574
Haiku 4.5 $0.00009 $0.00287

Measured 6d ago against content hash 2c533267f8c2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release-openspec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/release-openspec/SKILL.md · 182 lines

How it starts

The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release OpenSpec

Run the OpenSpec release workflow as a resumable state machine. Inspect live GitHub state on every invocation and take only the next safe action. Do not assume an earlier invocation completed.

Principles

  • Treat Fission-AI/OpenSpec and origin/main as the release source of truth.
  • Default to a read-only audit when the user asks for status, readiness, or advice.
  • Treat a request to release, prepare a release, continue, or resume as authorization to perform the applicable release actions.
  • Preserve the user's checkout. Never discard unrelated changes or switch their current branch just to prepare a changeset.
  • Use a temporary worktree from current origin/main for release-authored commits when the checkout is dirty or not on main.
  • Never approve your own PR. Human review is a deliberate gate.
  • Treat merge-queue entry as an intermediate state, not a merge. Advance only after GitHub reports mergedAt and the commit is present on main.
  • Never create the automated Version Packages PR manually. The Changesets action owns it.
  • Never push an empty commit merely to retrigger CI. Diagnose the failed or missing run first.
  • Report URLs, the state reached, and the exact human action needed whenever pausing.

Know the two PR types

Keep these distinct in output and decisions:

  • Changeset PR: A normal human-authored PR that adds one or more .changeset/*.md files. Prefer adding a changeset to the feature/fix PR; create a catch-up changeset PR only for already-merged work that should be included.
  • Version Packages PR: The automated changeset-release/main PR titled chore(release): version packages. Merging or adding changesets to main updates this same PR. Merging it publishes the stable release.

An open Version Packages PR does not prohibit a catch-up changeset PR. It means a catch-up PR is useful only when the audit finds missing release-worthy work. Once that PR merges, wait for the existing Version Packages PR to update.

Read the full file on GitHub · 182 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago Changed 2c533267f8c2
  2. 13d ago Changed · +1 lines df6977c31729
  3. 2mo ago First seen · 181 lines · 88 tokens per session scan A 56b391b3b4e8

Subscribe to this mod's changes

release-openspec is a skill published in the GitHub repository Fission-AI/OpenSpec (74,064 stars, last pushed yesterday), licensed MIT. It adds 88 tokens to every session and 2,870 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

release-openspec compared with skills from other repositories

release-openspec next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
release-openspecFission-AI/OpenSpecSkill74kyesterdayMITA88Codex
add-community-extensiongithub/spec-kitSkill148kyesterdayMITA63Claude Code
code-reviewgithub/spec-kitSkill148kyesterdayMITA54Claude Code
gsd-complete-milestoneopen-gsd/gsd-coreSkill11kyesterdayMITA16Claude Code
comet-archiverpamis/cometSkill3.3ktodayMITA34Codex
comet-releaserpamis/cometSkill3.3ktodayMITA65Claude Code, Codex
comet-safe-deliveryrpamis/cometSkill3.3ktodayMITA78Claude Code, Codex