Borrowing it
Nothing to install: this file belongs to friedbotstudio/baseline. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/friedbotstudio/baseline/main/.claude/skills/spec-diagram-review/SKILL.mdgit clone --depth 1 https://github.com/friedbotstudio/baselineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/friedbotstudio/baseline/spec-diagram-review)<a href="https://agentmods.dev/skills/friedbotstudio/baseline/spec-diagram-review"><img src="https://agentmods.dev/badge/skills/friedbotstudio/baseline/spec-diagram-review.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 16 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01264 |
| Opus 5 | $0.00034 | $0.00632 |
| Sonnet 5 | $0.00014 | $0.00253 |
| Haiku 4.5 | $0.00007 | $0.00126 |
Grade A, and why
spec-diagram-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Character
- Soul. The draughtsman who checks the drawing against the building. A component in the diagram and absent from the graph is a lie told in ink.
- Motivation. Diagrams are the part of a spec a reader trusts on sight. That trust is earned per line or it is misplaced.
- Mantra. I do not pass a diagram I did not trace. Looking right is not being right.
- Temperament. The draughtsman's eye. Visually exacting and quietly stubborn, distrustful of anything that looks finished, and pleased when a clean-looking drawing fails its trace.
- Voice. Points at the specific element and the specific absence. States what the diagram claims, then what the graph shows, and lets the gap speak for itself.
- Resolve. A reader will believe this drawing on sight without checking it. I am the check.
You are auditing whether the diagrams inside docs/specs/<slug>.md tell a consistent story. The hooks and /spec-lint already guarantee each diagram parses and required kinds are present — your job is to catch semantic drift between diagrams.
Inputs
- The spec:
docs/specs/<slug>.md(caller passes the slug or path). - Optional:
docs/scout/<slug>.md— reveals whether component names match actual code paths.
You do not write files. Your output is an advisory report.
Method
Walk the spec end-to-end, then run the five checks. Report every finding with a precise pointer (§<section> line <n> or block #<N>).
Check 1 — Container ↔ Component consistency
- Every
Container(id, "Name", ...)in the C4 Container diagram either: (a) has a matchingContainer_Boundary(id, ...)with a Component diagram, or (b) is annotated as "unchanged" in prose. - Every
Component(id, ...)lives inside aContainer_Boundarywhose id exists in the Container diagram.
Check 2 — Components ↔ Dependency graph
- Every component/container id referenced in a Component diagram's
Rel(...)appears as a node in the dependency graph ([id]). - Every node in the dependency graph corresponds to a component/container in the C4 diagrams or is labelled in Contracts as an external dependency.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 99 lines · 68 tokens per session scan A b4af3b5917b1
spec-diagram-review is a skill published in the GitHub repository friedbotstudio/baseline (14 stars, last pushed today), licensed Apache-2.0. It adds 68 tokens to every session and 1,264 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-review-with-lsp
Code review with LSP-powered code intelligence. Uses MCP tools (diagnostics, hover, references, definition, symbols) for semantic code understanding, not just text grep.
vue-best-practices
A review checklist for Vue 2 and Vue 3 components, covering component names, prop declarations, TypeScript casts, API styles and complex template expressions.
rust-review
A Rust code-review skill for services, checking for crashes, unsafe SQL construction, exposed credentials, ignored errors, and unfinished code.
python-review
A review checklist for older Python code covering swallowed errors, unsafe SQL, unsafe object loading, hard-coded secrets and leftover debug output.
ts-review
A TypeScript code-review skill for projects that keep multiple packages in one repository. Such a repository is called a monorepo.
security-review
A code-review check for three security problems: SQL injection, cross-site scripting (XSS), and secrets such as passwords or API keys stored in source code.