Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fjpulidop/specrails-core --skill opsx-ffgit clone --depth 1 https://github.com/fjpulidop/specrails-coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fjpulidop/specrails-core/opsx-ff)<a href="https://agentmods.dev/skills/fjpulidop/specrails-core/opsx-ff"><img src="https://agentmods.dev/badge/skills/fjpulidop/specrails-core/opsx-ff.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01188 |
| Opus 5 | $0.00016 | $0.00594 |
| Sonnet 5 | $0.00007 | $0.00238 |
| Haiku 4.5 | $0.00003 | $0.00119 |
Grade A, and why
opsx-ff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
89% identical to openspec-ff-change — 20 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenSpec project root. The
openspec/directory lives in the REPO, not the workspace this skill is driven from. The repo root is${SPECRAILS_REPO_DIR:-.}(a default-unset env var: when unset it resolves to., i.e. the current directory, so a classic in-repo run is unchanged). Run EVERYopenspeccommand against that root — wrap each invocation as(cd "${SPECRAILS_REPO_DIR:-.}" && openspec …). Treat${SPECRAILS_REPO_DIR:-.}as the OpenSpec project root for any path the CLI prints or you read/write.
Fast-forward through artifact creation - generate everything needed to start implementation in one go.
Input: The user's request should include a change name (kebab-case) OR a description of what they want to build.
Steps
-
If no clear input provided, ask what they want to build
Use the AskUserQuestion tool (open-ended, no preset options) to ask:
"What change do you want to work on? Describe what you want to build or fix."
From their description, derive a kebab-case name (e.g., "add user authentication" →
add-user-auth).IMPORTANT: Do NOT proceed without understanding what the user wants to build.
-
Create the change directory
(cd "${SPECRAILS_REPO_DIR:-.}" && openspec new change "<name>")This creates a scaffolded change at
openspec/changes/<name>/. -
Get the artifact build order
(cd "${SPECRAILS_REPO_DIR:-.}" && openspec status --change "<name>" --json)Parse the JSON to get:
applyRequires: array of artifact IDs needed before implementation (e.g.,["tasks"])artifacts: list of all artifacts with their status and dependencies
-
Create artifacts in sequence until apply-ready
Use the TodoWrite tool to track progress through the artifacts.
Loop through artifacts in dependency order (artifacts with no pending dependencies first):
a. For each artifact that is
ready(dependencies satisfied):- Get instructions:
(cd "${SPECRAILS_REPO_DIR:-.}" && openspec instructions <artifact-id> --change "<name>" --json) - The instructions JSON includes:
context: Project background (constraints for you - do NOT include in output)rules: Artifact-specific rules (constraints for you - do NOT include in output)template: The structure to use for your output fileinstruction: Schema-specific guidance for this artifact typeoutputPath: Where to write the artifactdependencies: Completed artifacts to read for context
- Read any completed dependency files for context
- Create the artifact file using
templateas the structure - Apply
contextandrulesas constraints - but do NOT copy them into the file - Show brief progress: "✓ Created "
b. Continue until all
applyRequiresartifacts are complete- After creating each artifact, re-run
openspec status --change "<name>" --json - Check if every artifact ID in
applyRequireshasstatus: "done"in the artifacts array - Stop when all
applyRequiresartifacts are done
c. If an artifact requires user input (unclear context):
- Use AskUserQuestion tool to clarify
- Then continue with creation
- Get instructions:
-
Show final status
(cd "${SPECRAILS_REPO_DIR:-.}" && openspec status --change "<name>")
Output
After completing all artifacts, summarize:
- Change name and location
- List of artifacts created with brief descriptions
- What's ready: "All artifacts created! Ready for implementation."
- Prompt: "Run
/opsx:applyor ask me to implement to start working on the tasks."
Artifact Creation Guidelines
- Follow the
instructionfield fromopenspec instructionsfor each artifact type - The schema defines what each artifact should contain - follow it
- Read dependency artifacts for context before creating new ones
- Use
templateas the structure for your output file - fill in its sections - IMPORTANT:
contextandrulesare constraints for YOU, not content for the file- Do NOT copy
<context>,<rules>,<project_context>blocks into the artifact - These guide what you write, but should never appear in the output
- Do NOT copy
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 110 lines · 33 tokens per session scan A fe89dd099013
opsx-ff is a skill published in the GitHub repository fjpulidop/specrails-core (9 stars, last pushed 1mo ago), licensed MIT. It adds 33 tokens to every session and 1,188 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 89% identical to openspec-ff-change, differing in 20 lines, and is treated as a copy.
Other skills, from other repositories
local-execution-planner
Plan a repository task for execution by a small local coding model, then hand the plan to the local executor over MCP. Inspect the codebase, decompose the work into self-contained sequential prompts, define deterministic eval gates, validate the manifest, and submit it for execution. Never implement the task.
taiyi-evolve
A workflow skill that compares the implemented code with the frozen design after development and testing. It records architecture changes and proposes updates to DESIGN.md, the document describing the intended system structure.
taiyi-diagram-c4
A code-scanning tool that builds C4 architecture documents from a repository. It separates facts observed in the code from conclusions inferred about the design and uses Mermaid diagrams as the source format.
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
huggingface-llm-trainer
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…